Questions about implementing Endpoint Security for Servers 5.2

[giantdave]

We are looking to replace McAfee MOVE AV with Endpoint Security for Servers v5.2.

I read through the documentation but still don't understand where and what Endpoint Security does the actual scanning.  Do we have to put Endpoint Security Threat Protection on the virtual clients or does it utilize the Endpoint Security installed on the ESXi server?

Also, it only talks about On-Demand scans via Endpoint Security for Servers.  Is this the only thing it controls?  What about On-Access scanning?

[thowell]

ENS for Servers lets EPO communicate with VSphere. We have started to implement this into our labs. The best benefits so far is the connection pulls in systems into a new area of the ePO system tree, if the system is not in ePO. You should reset sorting on these systems, as systems do not automatically sort, and if the GUID is reset the systems can end up into this areas of the system tree which can trigger different policies to be applied. 

The second benefit is you can implement smart scheduling of tasks such as full disk scanning. You set a scanning task for all servers limiting the hyper visor CPU % to lets say 60%, The smart schedular will kick off scans on systems until this limit is reached and then stop, until the CPU% drops below 60%. This reduces scanning storms in the VM environment and allows the hyper visors to not continuous spike CPU during scanning operations, during the allow scanning periods. 

have fun 

[giantdave]

Thanks for the response.  I understand all that you posted, but I'm assuming that Endpoint Threat Protection has to be installed on every virtual client since ENSS supports both Linux and Windows.  Am I right in my assumption?

[thowell · Accepted solution]

Yes, to use the Smart scheduling with ENS it will need to be installed on each clients if you want to scan with ENS, but the ENS for Servers, can also work with newer version of VirusScan. but you can also use ENS for Servers smart scheduling capabilities for other ePO server tasks to reduce the initial impact on the VSphere hyper visors.  

[kblowe]

Is ENSS really needed if there is a ENS On-Demand Scan click task scheduled to run outside of business hours on the weekend, randomly against VDI workstations/desktops?