Nod32 and M$ Forefront Questions

[dtakias]

I am big fan of Nod32 and been using it at home for quite some time now.

 

I am now thinking of getting a educational licenses for a few primary schools, though I would like to hear a few comments before.

 

• Are people who use Nod32 in education satisfied with the product till now?
  
• Does the centralised management/update actually work?
  
• How often does it push out new definitions?
  
• What port does the management software use for updates?
   
  

 

 

Also been reading on Microsoft ForeFront Client Security. Anybody used that? I've read that it requires WSUS do be present and operational.

 

thanks!

Edited November 23, 2009 by dtakias

[OutToLunch]

I am big fan of Nod32 and been using it at home for quite some time now.

 

I am now thinking of getting a educational licenses for a few primary schools, though I would like to hear a few comments before.

 

• Are people who use Nod32 in education satisfied with the product till now?
  
• Does the centralised management/update actually work?
  
• How often does it push out new definitions?
  
• What port does the management software use for updates?
   
  

 

 

Also been reading on Microsoft ForeFront Client Security. Anybody used that? I've read that it requires WSUS do be present and operational.

 

thanks!

 

No experience with ForeFront but on the NOD32 aspect -

 

1) Very satisfied - I dealt directly with Eset not a reseller and found them extremely helpfully - reset our trial time a number of times as we hadn't had time to evaluate properly and sorted out educational discounts and clarified various licensing issues for us being split site and boarding that were worrying me. Using it here since 2008, does a nice job of catching all the nasty USB stick viruses people bring in and occasionally anything that slips through on the unfiltered PCs.

 

2) Management/update works very well but definitely needs you to RTFM to get it up and running without problems. Has some nice little tricks such as being able to set it to use 2 different update servers if necessary + run direct connections to ESET servers when at home and update from the school server when in school.

 

3) Seem to be several definition updates a day but I think it's the client checking the centralised update server not the server pushing them - the server has a nice manglement console which reports which machines haven't checked in for a while etc.

 

4) The management server downloads updates via normal HTTP (80) from the Eset servers. Clients using the central mirror then download their updates by HTTP on 2221 but that's your internal server so shouldn't raise firewall issues. The management console aspect of the client connects to 2222 on the central server.

 

Hope this helps!

[ssiruuk2]

OuttoLunch - how did you get it to update from two different sources. This is the only problem / negative thing I can say about it. So much better than our previous AV (Etrust) - if you think Esets console could do better just take a peak at CA's effort!!!

 

I tried following the guide on the Eset site to get dual update servers going but it will never try the second source for me for some reason.

[bio]

I tried following the guide on the Eset site to get dual update servers going but it will never try the second source for me for some reason.

 

This should work just fine... just create a DNS record that points to 2 NOD servers... point the clients to the DNS record that you have made.

 

We are very happy with nod32 as well.. servicing 900 clients here

 

bio..

[dtakias]

The ability to update from home and school is very important as a lot of teachers take their laptops at home at the end of the day.

 

Also by using port 80 it should be able to get through the filtered LEA internet connection.

 

Which version you guys use, V3 or V4 ? I remember V4 been having some issues in the past.

[OutToLunch]

OuttoLunch - how did you get it to update from two different sources.

 

I was working from a pretty hefty PDF I'd downloaded from somewhere on the Eset site, should still be around somewhere - the method that it uses is 2 different scheduled updates, one to each server and then prioritising them so the mirror is always tried first... Seems to work ok - not sure if that's different to how you were trying to do it?

 

This should work just fine... just create a DNS record that points to 2 NOD servers... point the clients to the DNS record that you have made.

 

Doesn't work so well offsite though - I assumed that was what ssiruuk2 was asking about, could be wrong

 

Which version you guys use, V3 or V4 ? I remember V4 been having some issues in the past.

 

Using a mix of V3 and V4 here - V3 mainly, testing out V4 on new laptops + people who won't have heart failure if something crashes. V3 has been solid as a rock, noticed a few quirks on V4 on my admin machine, could be the amount of other things I've cluttered it up with over the years though.

[bio]

Which version you guys use, V3 or V4 ? I remember V4 been having some issues in the past.

 

Running v4 only... we migrated from v2.7 a month ago. We had some issues with v4 but its pretty stable now

 

bio..

[ssiruuk2]

I was using this:

 

ESET Knowledgebase - How do I create a dual update profile configuration? (2.7)

 

We are on version 3 but it didn't seem to work and I think thats for 2.7?

[jdeane]

You can use the link below for details on how to create a dual update profile for Eset v3 and v4 clients.

 

ESET Knowledgebase - How do I create a dual update profile configuration with ESET Remote Administrator? (3.0)

 

The Eset Remote Server (ERA) will download and provide the clients with the AV definitions, the ERA will download them from the internet using port 80, it can then either provide the updates to the clients either via http, default port 2221 (preferred method as no shares/premissions need to be set) or via file share. The clients by default will check for updates every 60 minutes from power on.

 

Depending on how many clients (>600) you have it may be better to provide the clients definitions via IIS as this can handle a lot more http connections than the Eset built in http server.

 

ESET Knowledgebase - How can I set up Microsoft IIS as an ESET update Mirror server?

[Simcfc73]

Had Nod32 for almost a year, I think the cleanup is brilliant (unlike Sophos) and the footprint is pretty good.

 

Terrible server console and the support is awful, Sophos was miles better in this respect.

 

I have issues with clients not talking to the server which means I need to stop and start a couple of services to get them talking again and I had lots of problems with v4 on the servers so all mine are back on 3.

 

Just my opinion

[jdeane]

If installing Eset v4 or infact any AV on to a server you need to make sure that you put in place the Microsoft recommended real-time AV scanning exclusions in place.

 

What Anti-Virus scanning exclusions should be considered for system and servers? - Shaun Cassells at MyITForum.com

 

ESET Knowledgebase - What are the recommended settings for ESET NOD32 Antivirus installed on a server? (4.0)

 

You should also make sure that you are using the latest version of the Eset software currently build v4.0.467 as this build has some server based optimization coding.

 

Please PM me your comments regarding the Eset support, as one of the senior Eset UK support engineers I'd like to find out what issues you've had in the past with the support.