Applying policies from EPO to standalone client

[User53835437]

We've a number of ENS Threat Prevention policies supplied by Headquarters, using these thru EPO on our clients. We've a number of standalone client installations in our DMZ, where we would like to use the same policy (settings). I've red about he ESConfigTool and the Endpoint Security Package Designer (ENSPD). Apparently there is no straightforward option to import the existing EPO based policies (delivered to us as xml files) into the standalone client. I followed the road of the ESConfigTool, and have exported the TP and ESP settings from my own workstation. Assuming this will contain all the applied, thru EPO, policy settings. Now, before applying this "preconfigured.policy" file to one of my DMZ based standalone clients, I'm wondering: - (how) can I verify that, and what, settings will be applied to my standalone installation - can I revers somehow the "ESConfigTool /import" if I find out that the policy is not working correct, or will I've to reinstall the standalone client - again, is there a way I can 'see' what additional settings have been applied to the ThreatPreventions Access Protection and Exploit Prevention 'modules'.

[Kenchee_etf · Accepted solution]

Hello @User53835437 

You are probably refering to:
*** McAfee Endpoint Security 10.7.x Installation Guide (Command-line options for exporting custom settings)
https://docs.mcafee.com/bundle/endpoint-security-10.7.x-installation-guide-windows/page/GUID-31F0BE9...

Now in regards to validation what is imported, ENSTP comes with preconfigured default policy which means it will not have custom configured rules for Access Protection, it will not have any exclusions for On-Access Scan, any custom rules or exclusions for Exploit Prevention etc.

So once you import it and no error is recorded, your standalone machine should have those custom configurations that mirror your machine from where custom policies came from.

Now in regards your question about reverting policy, when you install ENS on machine, as I mentioned, ENS will have default policy hence before you import custom policies, you may first export current one, aka default one, and if, once custom policies are imported, you want to revert them, you should be able to reimport default one back. I hope I am explaining myself properly.

So please let me know if you have any additional question.

Side note:
If you have lot of standalone nodes in DMZ, is there any reason why you don't have Agent Handler in DMZ as well in order for you to get capability to manage those DMZ nodes that are currently standalone?

[User53835437]

I’m sorry, attempted twice by following the link send to me, discovering that after typing my comments login attempts failed.

Anyway, thanks for your reaction.

Anyway, I’ve ‘discovered’ the options provided by ‘export /plaintext’.

- I can now see what is in the export, not only from my ‘source’ machine, but also from my standalone client before and after applying new settings via ESConfigTool /import

- as our DMZ started only recently to expand, I will verify your suggestion about ‘Agent Handlers’. No idea what that will bring yet.

Will report back.

[User53835437]

I could not have a full look at the Agent Handler functionalities. Security regulations disallow me from being able to access a database with system info (IP etc) from the DMZ.

So I will have to live with the ESConfigTool options.

[User53835437]

We decided to add an EPO server into our DMZ. Both for security, maintainability and transparancy.

I’m now trying to figutebout how to add a standalone installation to EPO.