I need to update McAfee's dat file using the superdat file. I run 95 & NT machines, most of the users do not have local admin rights on their NT boxes, so I need to change so that the superdat can update the scan engine. All users run their own logon scripts from the netlogon share (we use the dos scripts). What I want to do is some how use their existing scripts and add a link to a KIX script so that this can be done? Am I making sense..I think I just lost myself.

So I guess what I'm asking for is a bit of script that will give the superdat admin rights.

Also since I am new to this, what exactly has to be loaded on the server and 95 & NT machines. (KIX files)

Thks

1. do all NT workstations have the same local username/password ?

2. if the anwser to question 1 was No, then are you willing to place a domain admin username/password in a clear text file that anyone can read?

Because of the security risks, I took a different path, instead of launching superdat from the logon script, I instead reconfigured all of my NT workstations to preform scheduled autoupgrades, using a domain account that had been granted local administrator access.

the script that i used to moidfy all nt workstations can be found here.
Topic: Modify Mcafee 4.x on NT to use AutoUpgrade

and my post about Modified Superdats will be needed also.

Please let us know if you need more help

Bryce

In order to grant a program administrator access you will need to use su.exe

to use su.exe, you need the service suss installed and running

To install the suss service you need to have administrator access

In order to grant a program administrator access you will need to use su.exe

(i run ring's around you logically!!)

go here to see how to acclompich this http://www.neosoft.com/~brycel/kix/other_scripts/ and go to suss_installer.

Bryce

[This message has been edited by Bryce (edited 21 November 2000).]

To answer your question 1: yes the local admin account has the same username and password on all NT machines.

Because we are using separate login scripts for each user, what is the best way to do this..have the KIX script launch first or the individual scipt call the KIX script.

Also again what files need to be loaded on the PC's and server?

thanks for your help Bryce.

Ok lets start from the beginning, your users are running personal logon scripts? are these personal login scripts "kix scripts" or "bat files"?

For your win9x computers you should have no problem launching the supredat at logon however you chose to do it.

Your NT users will be broken down in to 2 main groups, those with local admin rights and those without local admin rights. For those with rights you can treat them just like you would the win9x users and launch the superdat from the logon script with out any special requirements. For those with out rights you will need to grant the superdat program local admin rights, this is accomplished with the NT Resource Kit tool SU.exe .

Using SU leads to some problems

1. Getting it installed, you have to have admin rights to install SU, but you need SU to grant a program admin rights, see the catch 22? I wrote a script that is ran from an administrators computer that will install SU onto a list of target computers (that fixes this problem).

2. Using SU requires that you place an administrators username/password into a plain text file that anyone can read. This is an extremely bad breach of security! But some people will think of it as an acceptable risk, the final call is up to you.

I have this same problem here too, and I have taken a different approach to fix it. To see what my solution was go here http://kixtart.org/board/Forum2/HTML/000834.html

Always glad to help
Bryce

I'm not completely sure if I follow your problem, but here is what we do. The first time we install McAfee on any NT account, we select the SYSTEM account to use with McAfee. Then all future upgrades are performed without a hitch and regardless of how the end-user is logged in to NT. We also use the auto-upgrade and auto-update features of McAfee and those seem to work fine as well.

I hope this helps .

;=========================================================================
;
; Make sure McAfee Virus Scan Software is installed before continuing
;
;
$RetCode = CompareFileTimes("C:\Program Files\Common Files\Network Associates\VirusScan Engine\4.0.xx\names.dat", "\\Barney\Apps\McAfee\Update\LastVersion\names.dat")
IF $RetCode = -1 OR $RetCode = -2 OR $RetCode = -3
LogEvent( 2, 1, @USERID + " has obsolete or missing virus software!", "\\Barney" )
MessageBox( "Your virus scanning software is out of date or has not been properly installed. You will not be allowed to log on to the network until you contact System Support for assistance. YOUR NETWORK DRIVES WERE NOT MAPPED!", "WARNING", 0)
GOTO Done
ENDIF

\\Barney is the name of our NT server and basically this bit of code compares the local DAT files against the lates on our server. If they don't match, we make an entry on the server's event log file and display a message on the user's machine and exit without mapping any drives. This adds one additional little safeguard against spreading a virus through our network.

When we receive a new DAT file update from McAfee, we move the current one (the one everyone should be using) to the LastVersion directory. Since DAT files are updated from MacAfee every week, this gives every user at least two weeks to get properly updated. Along with this we have automated the update and upgrade process, so if the user is connected, he will get updated.

It isn't pretty, but it works for us.

Do you schedule the autoupgrade process, or do you have your users initiate the autoupgrade?

If Mcafee task manager is running under the system account you can't schedule it to autoupgrade using a network resource, the system account can't access network resources. But if a user was to start the autoupgrade process by hand, the process runs under the user account, and i am guessing that you users have local admin rights?

Bryce

Topic: Modify Mcafee 4.x on NT to use AutoUpgrade

A lot of the limitations are not NAI's but a limitation/security of NT. When you install Mcafee, you are given the option of installing it to run under your choice of user account, or use the system account.

You can't use the system account if you want to schedule the autoupgrade because the system account can't access network resources.

You can set up Mcafee to use a USER account, but this user account will need to have local admin rights, and plus when the user changes their password, you will also need to update the account information for the Mcafee services.

What i did, was create a generic domain user account, modify Mcafee to run under this new domain user account, also granting this Mcafee account local admin rights, and logon on as a service right.

This gives Mcafee all of the local admin rights that it needs, plus the ability schedule autoupgrade to run from a network resource location. This eliminates any and all requirements from the user.

Bryce

One point. DO NOT have MCAFEE auto upgrade or auto update at startup. This caused all sorts of problems for our laptop users.

It is the same here. All users logon on to the domain, and they have no local admin rights.

Do you schedule the upgrades, or is this somehting that the users have to start by hand?

Bryce

There are also sections about updating Norton Antivirus and how to use the Windows 2000 RUNAS command (as opposed to SU). This book covers advanced WSH, KiXtart, Shell Scripting, AutoIt, ScriptIt, ADSI, WMI, logon scripting, and more. This book is really cool because it focuses on the topics and areas we deal with everyday. If you want to script it, its in here.

Here's the link:
http://www.coriolis.com/store/product.asp?sku=1241 http://www.amazon.com/exec/obidos/ASIN/1576108813/

PS: There are so many complicated postings about updating DAT files. Its really not that hard once you see it done correctly. I worked with NAI to create these scripts, and reluctantly they helped me out.

The reason for the number of complicated posts, is that there seems to be a small amount of confusion on this matter

Mostly concerning NT4.0 and if a user has local admin rights or not. If the user has local admin rights, then you can simply run the superdat file to upgrade Mcafee.

For users that don't have local admin rights, this is where the many different solutions have evolved. I personally do not suggest using SU method, since you would have to place a username/password that has at least local admin rights, in a clear text file that everyone can read.

I instead have chosen the more complicated but very secure method. This is using a standard domain user account, granting this domain user account local admin rights, and logon as a service rights. Modifying Mcafee to run under this domain user account, and finally modify/use Mcafee's own built in autoupgrade to use the superdat file to schedule and preform upgrades.

Of course with my approach you end up with a solution that you can't implement very well through a logon script, but works great when treated as an administrator script. By this I mean a script that is ran on a domain administrators computer, that connects to and makes changes on a list of target computers. It is also a use only once type of script, because when everything is all set and done the system takes care of it's self.

I am curious to see what approach you took to secure the username/password that is used in the RUNAS command for win2k computers.

Bryce