Create a New Policy (Windows)
Complete the following steps to create a new policy:
1. Click Create New Policy > Windows Policy.
2. Configure the General Settings:
A. Policy Name – Assign a policy name.
B. Update Mode – Select the preferred application update mode:
~ Semi-Automatic – Default settings for this policy are for maintenance to repeat from Monday to Sunday at 12:00 AM, applications configured for Automatic Update, and Windows Updates configured for Automatic Install.
~ Manual – When this policy is selected, the Schedule and Repeat On options are disabled. Applications are configured for Manual Update and the Windows Updates are not configured.
~ Scheduled – Default settings for this policy are for maintenance to repeat from Monday to Sunday at 12:00 AM, applications configured for Schedule Update, and only certain Windows Updates configured for Automatic Install. Patch Scan Frequency is set to Download And Keep Windows Updates Ready When Available.
~ Custom – Default settings for this policy are set for maintenance to repeat from Monday to Sunday at 12:00 AM, applications configured in a combination of Automatic, Manual, Schedule and Version Freeze update, and only certain Windows Updates configured for Automatic Install. Patch Scan Frequency is set to Download And Keep Windows Updates Ready When Available.
~ Version Freeze – When this policy is selected, the Schedule and Repeat On options are disabled. Applications are configured for Version Freeze and all Windows Updates are Denied. Once the app has been installed on the computer, the app will not be updated to the current version.
C. Schedule Mode – Select your preferred mode to initiate maintenance. You can choose Specify schedule – Weekly, Once A Day, or Specify schedule – Monthly.
 | The Maintenance period will last for a maximum of 3 hours. |
When you choose Specify Schedule – Weekly, configure the following options:
~ Time – Select the preferred time from the drop-down list or enter a specific time to initiate maintenance.
~ Repeat on – Select the days when the maintenance will repeat.
When you choose Once A Day, configure the following options:
~ When machine boots, start Maintenance Mode after X min – You can set the maximum time up to 60 minutes.
When you choose Specify Schedule – Monthly, configure the following options:
~ Time – Select the preferred time from the drop-down list or enter a specific time to initiate maintenance.
~ Date – Select the date when the maintenance will repeat every month. Pick a date between 1 to 28.
D. Notify User that computer is entering Maintenance Mode – Enable this option to notify the users when the computer is about to enter Maintenance Mode.
E. Allow Snooze – Select this option to allow user to snooze maintenance mode.
F. Password – Check the Enable Password Protection For Uninstalling The Deploy Agent checkbox to assign a password for uninstalling the Deploy Agent. Enter a password if you choose to enable password protection.
G. Proxy – Check Enable Proxy if you are using a proxy server to connect to the Internet and specify the proxy server settings:
~ Proxy Server Information – specify the values for Address and Port.
~ User Authentication – if your proxy requires authentication, check My Proxy Server Requires Authorization. Select or specify values for Authentication Type, Username, Password, and Domain.
3. Configure the Applications – Specify the application update mode for the apps. You can also set to Disable Shortcuts and Disable Auto Updates.
Disable Shortcuts and Disable Auto Updates will only work with Apps installed using Faronics Deploy.
4. Configure Windows Updates:
Do not manage Windows Updates – When this option is enabled, Deploy will not manage how Windows updates are downloaded.
A. Windows Update Settings – Select the types of updates to install and the install status:
Windows Update Type
~ Critical Update – A widely released fix for a specific problem that addresses a critical, non-security-related bug
~ Security Update – A widely released fix for a product-specific, security-related vulnerability. Security vulnerabilities are rated by their severity as critical, important, moderate, or low.
~ Definition Update – A widely released and frequent software update that contains additions to a product’s definition database often used to detect objects that have specific attributes such as malicious code, phishing websites, or junk mail.
~ Update Rollup – A tested, cumulative set of hotfixes, security updates, critical updates, and updates packaged together for easy deployment. A rollup generally targets a specific area (such as security), or a component of a product (such as Internet Information Services (IIS)).
~ Service pack – A tested, cumulative set of all hotfixes, security updates, critical updates, and updates. Additionally, service packs may contain additional fixes for problems that are found internally since the release of the product. Service packs may also contain a limited number of customer-requested design changes or features.
~ Tool – A utility or feature that helps complete a task or set of tasks.
~ Feature pack – New product functionality that is first distributed outside the context of a product release and that is typically included in the next full product release.
~ Updates – A widely released fix for a specific problem that addresses a non-critical, non-security-related bug.
~ Drivers* – Software that controls the lower level input and output of a device.
Drivers will only show up in the list when the Manage Driver Updates option is enabled.
~ Microsoft – Updates for Microsoft applications.
~ Upgrades – Feature updates to Windows Operating Systems.
Install status
~ Automatic Install – Select this option to automatically install category patches.
~ Automatically Install Deferral – Select this option to delay updates that are set to Automatic Install until up to X days from the date of the release of the update.
~ Denied – Select this option to deny installation of the category patches.
Manage driver updates – Enable this option to manage Driver Updates through Windows Updates.
Download and keep Windows updates ready when available – Enable this option to download updates outside of maintenance mode, and install the updates when maintenance starts.
B. Reboot Behavior Settings
~ Force auto-reboot prior to installation if user is logged on – Enable this option to force auto-reboot a computer when the machine goes into maintenance if a user is logged on. When selected, the user will receive a notification that the computer is scheduled for maintenance.
~ Allow user to defer reboot (if required) once update is completed
* Never reboot automatically – Enable this option to prevent the computer from automatically rebooting after an update has been completed.
* Defer reboot up to X times – Enable this option to allow users to defer rebooting of the computer up to a maximum of 5 times.
C. Patch Scan Frequency – Select from the drop-down list to schedule how frequently to perform patch scans.
~ Once every 24 hours
~ Once every 12 hours
~ Once every 6 hours
Additional Settings for Windows 10
For Windows 10, configure when feature updates or quality updates are to be installed and the targeted channel for which to install the updates.
> Semi-Annual Channel (Targeted) – Select this option to install the updates on select computers to evaluate the major release prior to deployment for the whole organization.
> Semi-Annual Channel – Select this option install the updates for all computers.
Feature updates include new capabilities and improvements. This update can be deferred until up to 365 days.
Quality updates include security improvements. This update can be deferred until up to 30 days.
5. Configure Anti-Virus – Click Enable Anti-Virus.
Anti-Virus
> Anti-Virus Settings
~ Enable Active Protection – Select to activate real-time protection for all computers using this policy.
 | Make sure there is no real-time protection software running on the computers. This includes third-party antivirus applications. |
* Allow user to switch off Active Protection – Select to allow users to switch off Active Protection.
* Show Active Protection Alert – Select to display Active protection alerts.
> Cleanup Action – Select the default action for infected files
~ Clean/Quarantine – When a threat is detected, attempt to disinfect the file and quarantine if unsuccessful. If the file could not be disinfected, it will be quarantined and will not be deleted.
~ Clean/Delete – When a threat is detected, attempt to disinfect the file and delete if unsuccessful. If the file could not be disinfected, it will be deleted from the computer.
~ Delete items from quarantine that are older than X days. Specify the number of days to retain items in quarantine. The default is 3 days. The maximum is 365 days.
> Scan Schedule – Enable the type of scan to schedule for this policy.
~ Quick Scan – Click the Edit icon for Quick Scan. Configure the following options and click Update.
* Enable Quick Scan – select the checkbox to enable Quick Scan.
* Start – specify the start time.
* Stop – specify the end time. The maximum duration between the Start time and Stop time is 23.59 hours. The scan ends if all the files are scanned before the Stop time. If the scan is not complete before the Stop time, it is aborted at the Stop time. Alternatively, select When scan is complete to ensure that scan is completed.
* Days – select the days when the scheduled Quick Scan will take place.
~ Deep Scan – Click the Edit icon for Deep Scan. Configure the following options and click Update.
* Enable Deep scan – select the checkbox to enable Deep Scan.
* Start – specify the start time.
* Stop – specify the end time. The maximum duration between the Start time and Stop time is 23.59 hours. The scan ends if all the files are scanned before the Stop time. If the scan is not complete before the Stop time, it is aborted at the Stop time. Alternatively, select When scan is complete to ensure that scan is completed.
* Days – select the days when the scheduled Deep Scan will take place.
> Scan Options
~ Randomize scheduled scan start times by x minutes – specify the number of minutes. The scheduled scan start time is randomized to reduce the impact on network traffic. This might impact the network traffic if the scan for multiple systems start at the same time.
If scan is missed, upon next startup: Select one of the following options on how a scan will be performed if the computer was not On during a scheduled scan:
~ Do not perform quick scan – select this option if you do not want to perform quick scan on startup.
~ Perform quick scan approximately x minutes after start-up – specify the number of minutes after start-up when Anti-Virus must perform a quick scan.
~ Prompt user to perform quick scan – select the option to prompt user to perform a quick scan.
> Advanced Options
For each type of scan, select the following options (some options may be grayed out depending on the type of scan):
~ Enable rootkit detection – detects if the computer is infected with a rootkit.
~ Scan inside archives – scans the contents of a zip file. Select for the scan to include archive files, such as .RAR and .ZIP files. When a .RAR file is found to contain an infected file, the .RAR file will be quarantined. If a .ZIP file is found to contain an infected file, the infected file is quarantined and replaced by a .TXT file with text indicating that it was infected and that it has been quarantined. Specify the File Size Limit.
~ Exclude removable drives (e.g USB) – excludes the removable drives from the scan process. Any external hard disks, USB drives etc will not be scanned.
~ Scan Registry – scans the registry for threats.
~ Scan Running Processes – scans all running processes on the computers.
~ Restore Defaults – click Restore Defaults if you want to restore all the default settings for the Advanced Options.
> Scan Exceptions
Specify the files or folders that are known to be safe. By adding the files or folders, Anti-Virus will not report the files as malicious or infected. The following list displays the items that will not be reported as virus.
i. Click +.
ii. In the Add Exception dialog, select File by Full Path or Entire Folder. Click Browse to select the file or folder and click OK.
> USB Devices
~ Scan USB drives upon insertion – select this option to scan USB drives upon insertion and select one of the following options:
* Interrupt active scan for USB scan – select this option to interrupt an active scan to scan the USB drive when it is inserted. Once the active scan is interrupted, it will not resume automatically and must be restarted manually.
* Do not perform a scan if another scan is already in progress – select this option to ensure that an active scan is not interrupted when a USB drive is inserted. The USB drive must be manually scanned once the active scan is complete.
~ Suppress USB scan in progress dialogue – select this option to hide indications that Anti-Virus is scanning USB drives when they are inserted; no Anti-Virus interface will open, and the system tray icon will not display tooltips indicating a scan in progress. Users will be notified at the end of a scan if a virus was found, but if no viruses were detected there will be no notification that the scan occurred.
Note that if the Scan USB drives upon insertion option is not selected, this option is ignored.
> Remove Anti-Virus – Click Uninstall Anti-Virus to remove Anti-Virus from all the computers on this policy.
Firewall Protection
> Firewall Protection Settings
~ Enable Firewall Protection – select the checkbox to enable Firewall Protection.
Firewall Protection prevents hackers or malicious software from gaining access to your computer through the Internet or the network.
* Allow users to disable firewall – select this option to allow users to disable the firewall at the computer.
* Enable Firewall Logging – select this option to log all actions related to the Firewall.
> Firewall Rules – Configure settings for Program Rules, Network Rules, Advanced Rule, Intrusion Rules, and Trusted Zones.
~ Program Rules
Program Rules define the action taken by the firewall on the network activity to and from an application. Program Rules have priority over the default rules. Default rules can be edited but cannot be deleted.
Click + to add a new Program Rule. Specify or select the options and click OK. The following parameters are displayed:
* Name – name of the rule.
* Program – name of the program, including full path and extension.
* Trusted Zone Inbound – the action to be taken for inbound communication to the program in a Trusted Zone (Allow or Block).
* Trusted Zone Outbound – the action to be taken for outbound communication from the program in a Trusted Zone (Allow or Block).
* Untrusted Zone Inbound – the action to be taken for inbound communication to the program in an Untrusted Zone (Allow or Block).
* Untrusted Zone Outbound – the action to be taken for inbound communication from the program in an Untrusted Zone (Allow or Block).
> Network Rules
Network Rules define the action taken by the firewall on the network activity. Network Rules can be edited but cannot be deleted. Select the Network Rules for the following:
Name | Description | Trusted Zone Inbound | Trusted Zone Outbound | Untrusted Zone Inbound | Untrusted Zone Inbound |
|---|---|---|---|---|---|
IGMP | Internet Group Management Protocol | Select Allow or Block | Select Allow or Block | Select Allow or Block | Select Allow or Block |
Ping | Ping and Tracert | Select Allow or Block | Select Allow or Block | Select Allow or Block | Select Allow or Block |
OtherIcmp | Other ICMP packets | Select Allow or Block | Select Allow or Block | Select Allow or Block | Select Allow or Block |
DHCP | Dynamic Host Configuration Protocol | Select Allow or Block | Select Allow or Block | Select Allow or Block | Select Allow or Block |
DNS | Domain Name System | Select Allow or Block | Select Allow or Block | Select Allow or Block | Select Allow or Block |
VPN | Virtual Private Network | Select Allow or Block | Select Allow or Block | Select Allow or Block | Select Allow or Block |
LDAP | Lightweight Directory Access Protocol | Select Allow or Block | Select Allow or Block | Select Allow or Block | Select Allow or Block |
Kerberos | Kerberos Protocols | Select Allow or Block | Select Allow or Block | Select Allow or Block | Select Allow or Block |
NETBIOS | Microsoft File and Printer Sharing | Select Allow or Block | Select Allow or Block | Select Allow or Block | Select Allow or Block |
> Advanced Rules
Advanced Rules define the action taken by the firewall for the specified application, port or protocol. This may include a single or a combination of protocol, local or remote ports, and direction of traffic. You can add, edit or delete an advanced rule.
Advanced Rules are processed in the order in which they are listed. Any user-defined advanced rules will take precedence over the Pre-defined Advanced Rules.
Click + to add a new Advanced Rule. Specify or select the options and click OK. The following parameters are displayed in the Advanced Rules pane:
~ Name – name of the rule.
~ Program – name of the program and path.
~ Action – the action taken by the Firewall for communication from the specified application, port or protocol (Allow or Block).
~ Direction – the direction of communication (Both, In or Out).
~ Protocol – Select the protocol and click Add.
~ Local Port – details of the local port.
~ Remote Port – details of the remote port.
> Trusted Zones
Trusted Zones specify computers, networks and IP addresses that are trusted. Network traffic from and to the Trusted Zones are not blocked. Trusted Zones and Internet (Non-Trusted) Zones can be treated differently by Program and Network Rules.
Click + to add a new Trusted Zone. Specify or select the options and click OK. The following parameters are displayed:
~ Name – name of the Trusted Zone.
~ Description – description of the Trusted Zone.
~ Type – type of the Trusted Zone (IP Address or Network).
Computer Settings
> User Actions
~ Show taskbar icon – select the checkbox to display Faronics Anti-Virus icon on the taskbar at the computer(s). If this checkbox is not selected, Faronics Anti-Virus will be hidden to the user.
~ Allow manual scanning – select the checkbox to allow users to manually initiate Anti-Virus scanning at the computer(s).
~ Allow user to take action on scan results – select the checkbox to allow the computer user to take action on the scan results.
~ Allow user to abort a scan initiated locally – select the checkbox to allow users to abort the scan initiated locally at the computer.
> Cache Server
You need to enable at least one computer as an Anti-Virus cache server. Refer to Action Toolbar for Computers.
~ Use Anti-Virus Cache Server – select the checkbox if you have set up an Anti-Virus Cache Server on your network that downloads and distributes virus definitions to all computers.
* Server Name – specify the name of the Anti-Virus Cache Server.
* Server IP – specify the IP address of the Anti-Virus Cache Server.
~ Connect to Web Server if there is no communication with the Anti-Virus Cache Server in the last x hours – select this option if the managed computers must connect to the Web Server through the Internet if the Anti-Virus Cache Server is not accessible for some reason.
> Windows Security Center
~ Integrate into Windows Security Center – select the checkbox to integrate Anti-Virus into the Windows Security Center. Windows Security Center will notify you via the System Tray if Anti-Virus is active or inactive.
> Log Actions – select the checkbox to enable Log Actions.
6. Click Save.