KACE Systems Management Appliance 9.1 Common Documents

NOTE: If you edit a template-based policy, keep Run As set to local system. Using local system ensures that the script has full access to the Windows system, including the registry. Running the script as a different user might not provide adequate access to the Windows system.

Add Internet Explorer scripts

Use this template to create a script that controls Internet Explorer preferences. You can control specific preferences while keeping others as user-defined.

Policy settings overwrite the corresponding user’s Internet Explorer preferences. Because this script modifies user settings, schedule it to run when users are logged in.

Go to the Security Policies list:

Log in to the KACE SMA Administrator Console, http://KACE_SMA_hostname/admin. Or, if the Show organization menu in admin header option is enabled in the appliance General Settings, select an organization in the drop-down list in the top-right corner of the page next to the login information.

On the left navigation bar, click Scripting, then click Security Policies.

Click Internet Explorer to display the Windows Internet Explorer page.

Provide the following information:

Option

Description

Name

A name that identifies the script. This name appears on the Scripts page.

User Home Page

Enforce User home page policy: Force the user’s home page to the specified page. Select the check box, then specify the URL to use as the home page.

Security

•

Enforce Internet Zone settings policy: Specify the security level for each zone. Select the check box, then choose the security level from the Security level drop-down list.

•

Enforce Local Internet Zone settings policy: Specify the security level for intranet zones. Select the check box, then choose the security level from the Security level drop-down list and choose the sites to include.

•

Enforce Trusted Zone settings policy: Specify the security level of trusted zones. Select the check box, then choose the security level from the Security level drop-down list.

•

Enforce Zone Map: Select the check box, then specify the IP addresses or ranges.

NOTE: Domains that are not listed default to the Internet Zone.

Privacy

Control the cookies and pop-ups that are accepted by Internet Explorer from the Internet Zone. Select from these options:

•

Enforce Privacy settings policy: Select the check box, then set the Cookie policy.

•

Enforce Pop-up settings policy: Select the check box, then set the Pop-up filter level.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add XP SP3 Firewall scripts

Use this template to create scripts that enforce firewall settings on Windows XP Service Pack 3 devices.

If target devices authenticate with a domain controller, they use the Domain Policy. Otherwise, they use the Standard Policy, and tighter restrictions might be advised.

Script settings override existing settings on devices. Further, if a script disables the firewall on a device, the device user cannot enable the firewall. If the firewall is set to no policy, the user's configuration for the firewall is used.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click XP SP3 Firewall to display the Windows XP SP3 Firewall page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
Domain Policy	The policy used when the device has authenticated with a domain controller. If you do not have a domain controller, use the Standard Policy configuration.
Standard Policy	The policy used when the device has not authenticated with a domain controller, for example, when a device user is at home or using a Wi-Fi® hotspot. This configuration is more restrictive than the Domain Policy.

NOTE: If the firewall is enabled, the policy settings override any settings the user might have set. If the firewall is disabled, the user cannot enable the firewall. If the firewall is set toNo Policy, the user's configurations for the firewall are used.

If you select the Enabled option for the firewall, specify the following options:

Option	Description
Enable logging	Enable the firewall to log information about the unsolicited incoming messages that it receives. The firewall also records information about messages that it blocks and successful inbound and outbound messages. Specify a location and name for the log file. The default is: C:\Program Files\KACE\firewall.log
Allow WMI traffic	Enable inbound TCP traffic on ports 135 and 445 to traverse the firewall. These ports are necessary for using remote administration tools such as the Microsoft Management Console (MMC) and Windows Management Instrumentation (WMI).
Allow Remote Desktop	Enable inbound TCP traffic on port 3389 to traverse the firewall. This port is required for the device to receive Remote Desktop requests.
Allow File and printer sharing	Enable inbound TCP traffic on ports 139 and 445, and inbound UDP traffic on ports 137 and 138. These ports are required for the device to act as a file or printer sharing server.
Allow Universal Plug-and-Play (UPnP)	Enable inbound TCP traffic on port 2869 and inbound UDP traffic on port 1900. These ports are required for the device to receive messages from plug-and-play network devices, such as routers with built-in firewalls.

To specify Inbound Port Exceptions, click Add Port Exception.

Inbound port exceptions enable additional ports to be opened in the firewall. These ports might be required for the device to run other network services. An Inbound Port Exception is automatically added for port 52230 for the KACE Agent Listener, which is required to use the Run Now command.

Specify a Name, Port, Protocol, and Source for the exception and click Save Changes.

Click Save at the bottom of the page to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

10.

Click Save.

Add McAfee AntiVirus scripts

Use this template to create scripts that install the selected McAfee VirusScan® features on devices.

Upload the McAfee Antivirus installation files to the appliance as a ZIP archive. When you upload the ZIP archive, the McAfee application is added to the appliance software inventory if it does not already exist.

This script verifies that the software is installed with the configuration you specify. The script also confirms that the On Access Scanner (McShield) is running.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click McAfee AntiVirus to display the McAfee Antivirus for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
McAfee 8.0 Setup Zip	The ZIP archive that contains the installation files to use for the script. click Browse or Choose File to select the ZIP archive. Click Software Inventory to go to the Software Detail page to select the ZIP archive.
User Interaction	How the installation appears to users. For a description of the available options, see the McAfee documentation.
McAfee Features	The features to be installed. Use Ctrl-click or Command-click to select multiple features. To install the Alert Manager, use the McAfee tools to include the Alert Manager installation files in the deployment package. See the McAfee documentation for information about available features.
Enable On-Access Scanner	Select this check box to start McAfee's automatic file scanner after the installation is complete. The On-Access scanner scans files whenever they are accessed, for example, when opening a file or running a program.
Preserve earlier version settings	Select this check box to preserve the present configuration settings for the On-Access Scanner before the update occurs.
Lockdown VirusScan Shortcuts	Select this check box to not display any VirusScan shortcuts in the Windows Start menu.
Remove other antivirus software	Select this check box to remove competing anti-virus software that could conflict with McAfee.
Installation Directory	The directory on the target device where the application is to be installed.
Source Paths	Provide the path to the source McAfee ZIP file uploaded to the appliance.
Logging	The information to record in the installation log. Use Ctrl-click or Command-click to select multiple items.
Log File Name	The name of the log file.
Additional Arguments	Any additional arguments.
Reboot	Whether to restart the target device after installation.
After Installation	The action to be performed after installation. Options include Run AutoUpdate or Run AutoUpdate silently. You can also select to Scan all local drives or Scan all local drives silently.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add McAfeeSuperDAT scripts

Use this template to create scripts that apply McAfee SuperDAT or XDAT updates to managed devices.

Obtain the McAfee SDAT or XDAT file to use with this script.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click McAfee SuperDAT to display the McAfee SuperDAT for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
SDAT or XDAT file	The installation files to use for the script. click Browse or Choose File to select the ZIP archive. Click Software Inventory to go to the Software Detail page to select the ZIP archive.
Install Silently	The file is installed without displaying installation feedback or progress on the device.
Prompt For Reboot	If the installation requires the device to be rebooted, prompt the user before rebooting.
Reboot If Needed	The device is rebooted as needed. Without this option, a silent installation does not reboot the device.
Force Update	All file versions are updated, even if the device already appears to have the latest versions.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add Symantec AntiVirus scripts

Use this template to create scripts that install and configure the Symantec AntiVirus application. The script is intended to run periodically to ensure that Symantec AntiVirus is configured and running properly.

Upload the Symantec AntiVirus.msi file to be distributed. When you upload the file, the application is added to the appliance inventory if it does not already exist.

Create an application inventory item and upload the Symantec AntiVirus.msi file to be distributed.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click Symantec AntiVirus to display the Symantec AntiVirus for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
Action	The task to be performed. Tasks include Install, Uninstall, Repair missing files, and Reinstall all files.
Software	The application to use for the script. To search for an application, begin typing in the field.
MSI Filename	The MSI filename (required if the file is a ZIP archive).
User Interaction	How the installation appears to users. Options include: Default, Silent, Basic UI, Reduced UI, and Full UI.
Install Directory	The directory on the target device where the application is to be installed.
Additional Switches	Any additional installer switches. Additional switches are inserted between the msiexe.exe and the /i foo.msi arguments.
Additional Properties	Any additional properties. These are inserted at the end of the command line. For example: msiexec.exe /s1 /switch2 /i patch123.msi TARGETDIR=C:\patcher PROP=A PROP2=B
After Install	What to do with the installation files when installation is complete.
Restart Options	Whether to restart the target device after installation.
Logging	The information to record in the installation log. Use Ctrl-click or Command-click to select multiple items.
Log File Name	The name of the log file.
Network Management	The network type.
Server Name	If you select Managed from the Network Management drop-down list, specify the server name.
Enable AutoProtect	The AutoProtect option.
Disable SymProtect	The Disable SymProtect option.
Run Live Update	The Live Update behavior.
Features to Install	The features you want to install from the Features to Install list. Use Ctrl-click or Command-click to select multiple features. See the Symantec documentation for specific information about the options available here. You must include the SAVMain feature for this script to work properly (although this template does not enforce this requirement).

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add XP SP3 Firewall scripts

Using Windows security policy templates

Add Internet Explorer scripts

Add XP SP3 Firewall scripts

Add McAfee AntiVirus scripts

Add McAfeeSuperDAT scripts

Add Symantec AntiVirus scripts

You can use security policy templates to create scripts that configure security settings on Windows devices.

Add Internet Explorer scripts

Use this template to create a script that controls Internet Explorer preferences. You can control specific preferences while keeping others as user-defined.

Policy settings overwrite the corresponding user’s Internet Explorer preferences. Because this script modifies user settings, schedule it to run when users are logged in.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click Internet Explorer to display the Windows Internet Explorer page.

Provide the following information:

Option

Description

Name

A name that identifies the script. This name appears on the Scripts page.

User Home Page

Enforce User home page policy: Force the user’s home page to the specified page. Select the check box, then specify the URL to use as the home page.

Security

•

Enforce Internet Zone settings policy: Specify the security level for each zone. Select the check box, then choose the security level from the Security level drop-down list.

•

Enforce Trusted Zone settings policy: Specify the security level of trusted zones. Select the check box, then choose the security level from the Security level drop-down list.

•

Enforce Zone Map: Select the check box, then specify the IP addresses or ranges.

NOTE: Domains that are not listed default to the Internet Zone.

Privacy

Control the cookies and pop-ups that are accepted by Internet Explorer from the Internet Zone. Select from these options:

•

Enforce Privacy settings policy: Select the check box, then set the Cookie policy.

•

Enforce Pop-up settings policy: Select the check box, then set the Pop-up filter level.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add XP SP3 Firewall scripts

Use this template to create scripts that enforce firewall settings on Windows XP Service Pack 3 devices.

If target devices authenticate with a domain controller, they use the Domain Policy. Otherwise, they use the Standard Policy, and tighter restrictions might be advised.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click XP SP3 Firewall to display the Windows XP SP3 Firewall page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
Domain Policy	The policy used when the device has authenticated with a domain controller. If you do not have a domain controller, use the Standard Policy configuration.
Standard Policy	The policy used when the device has not authenticated with a domain controller, for example, when a device user is at home or using a Wi-Fi® hotspot. This configuration is more restrictive than the Domain Policy.

If you select the Enabled option for the firewall, specify the following options:

Option	Description
Enable logging	Enable the firewall to log information about the unsolicited incoming messages that it receives. The firewall also records information about messages that it blocks and successful inbound and outbound messages. Specify a location and name for the log file. The default is: C:\Program Files\KACE\firewall.log
Allow WMI traffic	Enable inbound TCP traffic on ports 135 and 445 to traverse the firewall. These ports are necessary for using remote administration tools such as the Microsoft Management Console (MMC) and Windows Management Instrumentation (WMI).
Allow Remote Desktop	Enable inbound TCP traffic on port 3389 to traverse the firewall. This port is required for the device to receive Remote Desktop requests.
Allow File and printer sharing	Enable inbound TCP traffic on ports 139 and 445, and inbound UDP traffic on ports 137 and 138. These ports are required for the device to act as a file or printer sharing server.
Allow Universal Plug-and-Play (UPnP)	Enable inbound TCP traffic on port 2869 and inbound UDP traffic on port 1900. These ports are required for the device to receive messages from plug-and-play network devices, such as routers with built-in firewalls.

To specify Inbound Port Exceptions, click Add Port Exception.

Specify a Name, Port, Protocol, and Source for the exception and click Save Changes.

Click Save at the bottom of the page to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

10.

Click Save.

Add McAfee AntiVirus scripts

Use this template to create scripts that install the selected McAfee VirusScan® features on devices.

This script verifies that the software is installed with the configuration you specify. The script also confirms that the On Access Scanner (McShield) is running.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click McAfee AntiVirus to display the McAfee Antivirus for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
McAfee 8.0 Setup Zip	The ZIP archive that contains the installation files to use for the script. click Browse or Choose File to select the ZIP archive. Click Software Inventory to go to the Software Detail page to select the ZIP archive.
User Interaction	How the installation appears to users. For a description of the available options, see the McAfee documentation.
McAfee Features	The features to be installed. Use Ctrl-click or Command-click to select multiple features. To install the Alert Manager, use the McAfee tools to include the Alert Manager installation files in the deployment package. See the McAfee documentation for information about available features.
Enable On-Access Scanner	Select this check box to start McAfee's automatic file scanner after the installation is complete. The On-Access scanner scans files whenever they are accessed, for example, when opening a file or running a program.
Preserve earlier version settings	Select this check box to preserve the present configuration settings for the On-Access Scanner before the update occurs.
Lockdown VirusScan Shortcuts	Select this check box to not display any VirusScan shortcuts in the Windows Start menu.
Remove other antivirus software	Select this check box to remove competing anti-virus software that could conflict with McAfee.
Installation Directory	The directory on the target device where the application is to be installed.
Source Paths	Provide the path to the source McAfee ZIP file uploaded to the appliance.
Logging	The information to record in the installation log. Use Ctrl-click or Command-click to select multiple items.
Log File Name	The name of the log file.
Additional Arguments	Any additional arguments.
Reboot	Whether to restart the target device after installation.
After Installation	The action to be performed after installation. Options include Run AutoUpdate or Run AutoUpdate silently. You can also select to Scan all local drives or Scan all local drives silently.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add McAfeeSuperDAT scripts

Use this template to create scripts that apply McAfee SuperDAT or XDAT updates to managed devices.

Obtain the McAfee SDAT or XDAT file to use with this script.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click McAfee SuperDAT to display the McAfee SuperDAT for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
SDAT or XDAT file	The installation files to use for the script. click Browse or Choose File to select the ZIP archive. Click Software Inventory to go to the Software Detail page to select the ZIP archive.
Install Silently	The file is installed without displaying installation feedback or progress on the device.
Prompt For Reboot	If the installation requires the device to be rebooted, prompt the user before rebooting.
Reboot If Needed	The device is rebooted as needed. Without this option, a silent installation does not reboot the device.
Force Update	All file versions are updated, even if the device already appears to have the latest versions.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add Symantec AntiVirus scripts

Upload the Symantec AntiVirus.msi file to be distributed. When you upload the file, the application is added to the appliance inventory if it does not already exist.

Create an application inventory item and upload the Symantec AntiVirus.msi file to be distributed.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click Symantec AntiVirus to display the Symantec AntiVirus for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
Action	The task to be performed. Tasks include Install, Uninstall, Repair missing files, and Reinstall all files.
Software	The application to use for the script. To search for an application, begin typing in the field.
MSI Filename	The MSI filename (required if the file is a ZIP archive).
User Interaction	How the installation appears to users. Options include: Default, Silent, Basic UI, Reduced UI, and Full UI.
Install Directory	The directory on the target device where the application is to be installed.
Additional Switches	Any additional installer switches. Additional switches are inserted between the msiexe.exe and the /i foo.msi arguments.
Additional Properties	Any additional properties. These are inserted at the end of the command line. For example: msiexec.exe /s1 /switch2 /i patch123.msi TARGETDIR=C:\patcher PROP=A PROP2=B
After Install	What to do with the installation files when installation is complete.
Restart Options	Whether to restart the target device after installation.
Logging	The information to record in the installation log. Use Ctrl-click or Command-click to select multiple items.
Log File Name	The name of the log file.
Network Management	The network type.
Server Name	If you select Managed from the Network Management drop-down list, specify the server name.
Enable AutoProtect	The AutoProtect option.
Disable SymProtect	The Disable SymProtect option.
Run Live Update	The Live Update behavior.
Features to Install	The features you want to install from the Features to Install list. Use Ctrl-click or Command-click to select multiple features. See the Symantec documentation for specific information about the options available here. You must include the SAVMain feature for this script to work properly (although this template does not enforce this requirement).

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add McAfee AntiVirus scripts

Using Windows security policy templates

Add Internet Explorer scripts

Add XP SP3 Firewall scripts

Add McAfee AntiVirus scripts

Add McAfeeSuperDAT scripts

Add Symantec AntiVirus scripts

You can use security policy templates to create scripts that configure security settings on Windows devices.

Add Internet Explorer scripts

Use this template to create a script that controls Internet Explorer preferences. You can control specific preferences while keeping others as user-defined.

Policy settings overwrite the corresponding user’s Internet Explorer preferences. Because this script modifies user settings, schedule it to run when users are logged in.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click Internet Explorer to display the Windows Internet Explorer page.

Provide the following information:

Option

Description

Name

A name that identifies the script. This name appears on the Scripts page.

User Home Page

Enforce User home page policy: Force the user’s home page to the specified page. Select the check box, then specify the URL to use as the home page.

Security

•

Enforce Internet Zone settings policy: Specify the security level for each zone. Select the check box, then choose the security level from the Security level drop-down list.

•

Enforce Trusted Zone settings policy: Specify the security level of trusted zones. Select the check box, then choose the security level from the Security level drop-down list.

•

Enforce Zone Map: Select the check box, then specify the IP addresses or ranges.

NOTE: Domains that are not listed default to the Internet Zone.

Privacy

Control the cookies and pop-ups that are accepted by Internet Explorer from the Internet Zone. Select from these options:

•

Enforce Privacy settings policy: Select the check box, then set the Cookie policy.

•

Enforce Pop-up settings policy: Select the check box, then set the Pop-up filter level.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add XP SP3 Firewall scripts

Use this template to create scripts that enforce firewall settings on Windows XP Service Pack 3 devices.

If target devices authenticate with a domain controller, they use the Domain Policy. Otherwise, they use the Standard Policy, and tighter restrictions might be advised.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click XP SP3 Firewall to display the Windows XP SP3 Firewall page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
Domain Policy	The policy used when the device has authenticated with a domain controller. If you do not have a domain controller, use the Standard Policy configuration.
Standard Policy	The policy used when the device has not authenticated with a domain controller, for example, when a device user is at home or using a Wi-Fi® hotspot. This configuration is more restrictive than the Domain Policy.

If you select the Enabled option for the firewall, specify the following options:

Option	Description
Enable logging	Enable the firewall to log information about the unsolicited incoming messages that it receives. The firewall also records information about messages that it blocks and successful inbound and outbound messages. Specify a location and name for the log file. The default is: C:\Program Files\KACE\firewall.log
Allow WMI traffic	Enable inbound TCP traffic on ports 135 and 445 to traverse the firewall. These ports are necessary for using remote administration tools such as the Microsoft Management Console (MMC) and Windows Management Instrumentation (WMI).
Allow Remote Desktop	Enable inbound TCP traffic on port 3389 to traverse the firewall. This port is required for the device to receive Remote Desktop requests.
Allow File and printer sharing	Enable inbound TCP traffic on ports 139 and 445, and inbound UDP traffic on ports 137 and 138. These ports are required for the device to act as a file or printer sharing server.
Allow Universal Plug-and-Play (UPnP)	Enable inbound TCP traffic on port 2869 and inbound UDP traffic on port 1900. These ports are required for the device to receive messages from plug-and-play network devices, such as routers with built-in firewalls.

To specify Inbound Port Exceptions, click Add Port Exception.

Specify a Name, Port, Protocol, and Source for the exception and click Save Changes.

Click Save at the bottom of the page to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

10.

Click Save.

Add McAfee AntiVirus scripts

Use this template to create scripts that install the selected McAfee VirusScan® features on devices.

This script verifies that the software is installed with the configuration you specify. The script also confirms that the On Access Scanner (McShield) is running.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click McAfee AntiVirus to display the McAfee Antivirus for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
McAfee 8.0 Setup Zip	The ZIP archive that contains the installation files to use for the script. click Browse or Choose File to select the ZIP archive. Click Software Inventory to go to the Software Detail page to select the ZIP archive.
User Interaction	How the installation appears to users. For a description of the available options, see the McAfee documentation.
McAfee Features	The features to be installed. Use Ctrl-click or Command-click to select multiple features. To install the Alert Manager, use the McAfee tools to include the Alert Manager installation files in the deployment package. See the McAfee documentation for information about available features.
Enable On-Access Scanner	Select this check box to start McAfee's automatic file scanner after the installation is complete. The On-Access scanner scans files whenever they are accessed, for example, when opening a file or running a program.
Preserve earlier version settings	Select this check box to preserve the present configuration settings for the On-Access Scanner before the update occurs.
Lockdown VirusScan Shortcuts	Select this check box to not display any VirusScan shortcuts in the Windows Start menu.
Remove other antivirus software	Select this check box to remove competing anti-virus software that could conflict with McAfee.
Installation Directory	The directory on the target device where the application is to be installed.
Source Paths	Provide the path to the source McAfee ZIP file uploaded to the appliance.
Logging	The information to record in the installation log. Use Ctrl-click or Command-click to select multiple items.
Log File Name	The name of the log file.
Additional Arguments	Any additional arguments.
Reboot	Whether to restart the target device after installation.
After Installation	The action to be performed after installation. Options include Run AutoUpdate or Run AutoUpdate silently. You can also select to Scan all local drives or Scan all local drives silently.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add McAfeeSuperDAT scripts

Use this template to create scripts that apply McAfee SuperDAT or XDAT updates to managed devices.

Obtain the McAfee SDAT or XDAT file to use with this script.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click McAfee SuperDAT to display the McAfee SuperDAT for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
SDAT or XDAT file	The installation files to use for the script. click Browse or Choose File to select the ZIP archive. Click Software Inventory to go to the Software Detail page to select the ZIP archive.
Install Silently	The file is installed without displaying installation feedback or progress on the device.
Prompt For Reboot	If the installation requires the device to be rebooted, prompt the user before rebooting.
Reboot If Needed	The device is rebooted as needed. Without this option, a silent installation does not reboot the device.
Force Update	All file versions are updated, even if the device already appears to have the latest versions.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add Symantec AntiVirus scripts

Upload the Symantec AntiVirus.msi file to be distributed. When you upload the file, the application is added to the appliance inventory if it does not already exist.

Create an application inventory item and upload the Symantec AntiVirus.msi file to be distributed.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click Symantec AntiVirus to display the Symantec AntiVirus for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
Action	The task to be performed. Tasks include Install, Uninstall, Repair missing files, and Reinstall all files.
Software	The application to use for the script. To search for an application, begin typing in the field.
MSI Filename	The MSI filename (required if the file is a ZIP archive).
User Interaction	How the installation appears to users. Options include: Default, Silent, Basic UI, Reduced UI, and Full UI.
Install Directory	The directory on the target device where the application is to be installed.
Additional Switches	Any additional installer switches. Additional switches are inserted between the msiexe.exe and the /i foo.msi arguments.
Additional Properties	Any additional properties. These are inserted at the end of the command line. For example: msiexec.exe /s1 /switch2 /i patch123.msi TARGETDIR=C:\patcher PROP=A PROP2=B
After Install	What to do with the installation files when installation is complete.
Restart Options	Whether to restart the target device after installation.
Logging	The information to record in the installation log. Use Ctrl-click or Command-click to select multiple items.
Log File Name	The name of the log file.
Network Management	The network type.
Server Name	If you select Managed from the Network Management drop-down list, specify the server name.
Enable AutoProtect	The AutoProtect option.
Disable SymProtect	The Disable SymProtect option.
Run Live Update	The Live Update behavior.
Features to Install	The features you want to install from the Features to Install list. Use Ctrl-click or Command-click to select multiple features. See the Symantec documentation for specific information about the options available here. You must include the SAVMain feature for this script to work properly (although this template does not enforce this requirement).

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add McAfeeSuperDAT scripts

Using Windows security policy templates

Add Internet Explorer scripts

Add XP SP3 Firewall scripts

Add McAfee AntiVirus scripts

Add McAfeeSuperDAT scripts

Add Symantec AntiVirus scripts

You can use security policy templates to create scripts that configure security settings on Windows devices.

Add Internet Explorer scripts

Use this template to create a script that controls Internet Explorer preferences. You can control specific preferences while keeping others as user-defined.

Policy settings overwrite the corresponding user’s Internet Explorer preferences. Because this script modifies user settings, schedule it to run when users are logged in.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click Internet Explorer to display the Windows Internet Explorer page.

Provide the following information:

Option

Description

Name

A name that identifies the script. This name appears on the Scripts page.

User Home Page

Enforce User home page policy: Force the user’s home page to the specified page. Select the check box, then specify the URL to use as the home page.

Security

•

Enforce Internet Zone settings policy: Specify the security level for each zone. Select the check box, then choose the security level from the Security level drop-down list.

•

Enforce Trusted Zone settings policy: Specify the security level of trusted zones. Select the check box, then choose the security level from the Security level drop-down list.

•

Enforce Zone Map: Select the check box, then specify the IP addresses or ranges.

NOTE: Domains that are not listed default to the Internet Zone.

Privacy

Control the cookies and pop-ups that are accepted by Internet Explorer from the Internet Zone. Select from these options:

•

Enforce Privacy settings policy: Select the check box, then set the Cookie policy.

•

Enforce Pop-up settings policy: Select the check box, then set the Pop-up filter level.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add XP SP3 Firewall scripts

Use this template to create scripts that enforce firewall settings on Windows XP Service Pack 3 devices.

If target devices authenticate with a domain controller, they use the Domain Policy. Otherwise, they use the Standard Policy, and tighter restrictions might be advised.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click XP SP3 Firewall to display the Windows XP SP3 Firewall page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
Domain Policy	The policy used when the device has authenticated with a domain controller. If you do not have a domain controller, use the Standard Policy configuration.
Standard Policy	The policy used when the device has not authenticated with a domain controller, for example, when a device user is at home or using a Wi-Fi® hotspot. This configuration is more restrictive than the Domain Policy.

If you select the Enabled option for the firewall, specify the following options:

Option	Description
Enable logging	Enable the firewall to log information about the unsolicited incoming messages that it receives. The firewall also records information about messages that it blocks and successful inbound and outbound messages. Specify a location and name for the log file. The default is: C:\Program Files\KACE\firewall.log
Allow WMI traffic	Enable inbound TCP traffic on ports 135 and 445 to traverse the firewall. These ports are necessary for using remote administration tools such as the Microsoft Management Console (MMC) and Windows Management Instrumentation (WMI).
Allow Remote Desktop	Enable inbound TCP traffic on port 3389 to traverse the firewall. This port is required for the device to receive Remote Desktop requests.
Allow File and printer sharing	Enable inbound TCP traffic on ports 139 and 445, and inbound UDP traffic on ports 137 and 138. These ports are required for the device to act as a file or printer sharing server.
Allow Universal Plug-and-Play (UPnP)	Enable inbound TCP traffic on port 2869 and inbound UDP traffic on port 1900. These ports are required for the device to receive messages from plug-and-play network devices, such as routers with built-in firewalls.

To specify Inbound Port Exceptions, click Add Port Exception.

Specify a Name, Port, Protocol, and Source for the exception and click Save Changes.

Click Save at the bottom of the page to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

10.

Click Save.

Add McAfee AntiVirus scripts

Use this template to create scripts that install the selected McAfee VirusScan® features on devices.

This script verifies that the software is installed with the configuration you specify. The script also confirms that the On Access Scanner (McShield) is running.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click McAfee AntiVirus to display the McAfee Antivirus for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
McAfee 8.0 Setup Zip	The ZIP archive that contains the installation files to use for the script. click Browse or Choose File to select the ZIP archive. Click Software Inventory to go to the Software Detail page to select the ZIP archive.
User Interaction	How the installation appears to users. For a description of the available options, see the McAfee documentation.
McAfee Features	The features to be installed. Use Ctrl-click or Command-click to select multiple features. To install the Alert Manager, use the McAfee tools to include the Alert Manager installation files in the deployment package. See the McAfee documentation for information about available features.
Enable On-Access Scanner	Select this check box to start McAfee's automatic file scanner after the installation is complete. The On-Access scanner scans files whenever they are accessed, for example, when opening a file or running a program.
Preserve earlier version settings	Select this check box to preserve the present configuration settings for the On-Access Scanner before the update occurs.
Lockdown VirusScan Shortcuts	Select this check box to not display any VirusScan shortcuts in the Windows Start menu.
Remove other antivirus software	Select this check box to remove competing anti-virus software that could conflict with McAfee.
Installation Directory	The directory on the target device where the application is to be installed.
Source Paths	Provide the path to the source McAfee ZIP file uploaded to the appliance.
Logging	The information to record in the installation log. Use Ctrl-click or Command-click to select multiple items.
Log File Name	The name of the log file.
Additional Arguments	Any additional arguments.
Reboot	Whether to restart the target device after installation.
After Installation	The action to be performed after installation. Options include Run AutoUpdate or Run AutoUpdate silently. You can also select to Scan all local drives or Scan all local drives silently.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add McAfeeSuperDAT scripts

Use this template to create scripts that apply McAfee SuperDAT or XDAT updates to managed devices.

Obtain the McAfee SDAT or XDAT file to use with this script.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click McAfee SuperDAT to display the McAfee SuperDAT for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
SDAT or XDAT file	The installation files to use for the script. click Browse or Choose File to select the ZIP archive. Click Software Inventory to go to the Software Detail page to select the ZIP archive.
Install Silently	The file is installed without displaying installation feedback or progress on the device.
Prompt For Reboot	If the installation requires the device to be rebooted, prompt the user before rebooting.
Reboot If Needed	The device is rebooted as needed. Without this option, a silent installation does not reboot the device.
Force Update	All file versions are updated, even if the device already appears to have the latest versions.

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Add Symantec AntiVirus scripts

Upload the Symantec AntiVirus.msi file to be distributed. When you upload the file, the application is added to the appliance inventory if it does not already exist.

Create an application inventory item and upload the Symantec AntiVirus.msi file to be distributed.

Go to the Security Policies list:

On the left navigation bar, click Scripting, then click Security Policies.

Click Symantec AntiVirus to display the Symantec AntiVirus for Windows page.

Provide the following information:

Option	Description
Name	A name that identifies the script. This name appears on the Scripts page.
Action	The task to be performed. Tasks include Install, Uninstall, Repair missing files, and Reinstall all files.
Software	The application to use for the script. To search for an application, begin typing in the field.
MSI Filename	The MSI filename (required if the file is a ZIP archive).
User Interaction	How the installation appears to users. Options include: Default, Silent, Basic UI, Reduced UI, and Full UI.
Install Directory	The directory on the target device where the application is to be installed.
Additional Switches	Any additional installer switches. Additional switches are inserted between the msiexe.exe and the /i foo.msi arguments.
Additional Properties	Any additional properties. These are inserted at the end of the command line. For example: msiexec.exe /s1 /switch2 /i patch123.msi TARGETDIR=C:\patcher PROP=A PROP2=B
After Install	What to do with the installation files when installation is complete.
Restart Options	Whether to restart the target device after installation.
Logging	The information to record in the installation log. Use Ctrl-click or Command-click to select multiple items.
Log File Name	The name of the log file.
Network Management	The network type.
Server Name	If you select Managed from the Network Management drop-down list, specify the server name.
Enable AutoProtect	The AutoProtect option.
Disable SymProtect	The Disable SymProtect option.
Run Live Update	The Live Update behavior.
Features to Install	The features you want to install from the Features to Install list. Use Ctrl-click or Command-click to select multiple features. See the Symantec documentation for specific information about the options available here. You must include the SAVMain feature for this script to work properly (although this template does not enforce this requirement).

Click Save to display the Script Detail page.

Select options for configuration, deployment, and scheduling. See Add offline KScripts or online KScripts.

To edit the raw XML used in the script, click Edit XML below the Schedule section.

Click Save.

Documents connexes

KACE Systems Management Appliance 9.1 Common Documents - Administrator Guide

Add Internet Explorer scripts

Add XP SP3 Firewall scripts

Add McAfee AntiVirus scripts

Add McAfeeSuperDAT scripts