F-Secure Client Security and Policy Manager rollout implementation This article contains some pointers about installing F-Secure Client Security and F-Secure Policy Manager. It is intended for use by technical staff to assist in the planning process.
Planning the installation and number of servers required
- Use one Policy Manager Server (PMS) for every 10.000 clients if possible.
- More than 10.000 clients per PMS can be difficult to administer and also places additional load on the server which can lead to a negative user experience.
- Use one Policy Manager Server per branch office or at least "major branch office".
- Deploy a Policy Manager Proxy Server (PMP) installation in each branch office where no PMS is installed that has more than ~10 clients.
Rolling out: Preparation
- Create the policy domain structure before rolling out the clients.
- Configure the policy before rolling out the clients. Firewall rules and PMP configuration are worthy of special attention in a distributed environment!
- Create autoimport rules and check that they function correctly before rolling out.
Rolling out: Implementation
- Push-installing more than 20 or so clients at a time from the Policy Manager Console (PMC) is not recommended. It is possible that even with these 'low' numbers, the PMC machine will be unusable for an hour or more.
- For major rollouts, use a batch calling ilaunchr and use preconfigured JAR package or a MSI installer exported using Policy Manager Console.
- Use System Center Configuration Manager (SCCM) or other similar tools for deploying the JAR or MSI installation.
- Deploy the installation to a test environment ("beta group") with at least 10 as "different as possible" clients before running the rollout batch.
- Test specifically for failing sidegrade, where used; create a brute force removal tool if necessary and test it before the rollout.
- Roll out small groups of computers at once and then thoroughly test them before continuing; fixing 50 clients is significantly easier than 500.