Adding local service mode managed systems

To download the installation package, from the Bravura Security Fabric main menu:

You can now install the Local Workstation Service installation package.

This section shows you how to install the Local Workstation Service on a Windows server or workstation by manually running the MSI installer that you downloaded in Downloading the installation package .

You can also install the software automatically. For example, use a software package distribution product like Microsoft’s System Center Configuration Manager and use the command line options or use group policy.

See Add-on installation command-line options for more information on the command-line options.

If you use workstation images you can install Local Workstation Service as described below. Disable the service by default and configure to Automatic after the image is placed on the workstation if you want to use the Local Workstation Service.

You can use a plugin to digitally sign files if required. See Digitally signing files for details.

To install the Local Workstation Service manually:

The Local Workstation Service can now contact the Bravura Privilege server to register the host system as a discovered object. Once the service has contacted the server, it sends its system data and registers itself as a discovered system. The default interval for this initial registration is 300 seconds. After registration, the service periodically polls the Bravura Security Fabric to determine whether any jobs, such as password change or attribute listing, are required on the host system. Depending on the task that has been assigned, the service will contact the server at different intervals. If no tasks are assigned, the service will wait the poll time, as defined by the RES POLL INTERVAL, until it rechecks the server for tasks.

If the Local Workstation Service is unable to contact the Bravura Privilege server using the proxy server, it will attempt to poll again without connecting to the proxy server.

In local service mode, a service running locally on the managed system, connects via TLS-encrypted communication over a single outgoing port, the one port made available by the IIS web server into the Bravura Privilege nodes, by default, that port is 443. Please ensure, through either firewall, switch, proxies, tunneling or other networking configuration, that the workstations on which the Local Workstation Service is installed can connect to the Bravura Privilege server IIS.

You can capture log data on local service mode managed systems using the logutil program which is installed with the service.

Custom attribute file

You can use custom system attributes to define requirements for import rules. For local service mode systems, computer information is not stored on the Bravura Privilege server, but locally on the system itself.

The local service installer can read a custom attribute file and send information back to the server to be used by import rules as discovered system attributes. The custom attribute file must be in KVGroup format:

# KVGROUP-V2.0 
"custom_attribute" "" = { 
  "<attribute1>" = "value1"; 
  "<attribute2>" = "value2"; 
  ... 
  "<multi-valued attribute1>" "" = { 
     "<mv1-value1>"; 
     "<mv1-value2>"; 
     ... 
  "<multi-valued attribute2>" "" = { 
     "<mv2-value1>"; 
     .... 
  }; 
}; 

For example:

# KVGROUP-V2.0 
"custom_attribute" "" = { 
  "location" = "calgary"; 
  "system_type" = "laptop"; 
 
  "departments" "" = { 
     "sales"; 
     "marketing"; 
  }; 
}; 

There are some restrictions on what names the custom attributes may use. If any of the custom attributes are using these values, they will invalidate the attribute file and any new attributes will not be sent to the Bravura Privilege server. The attribute names such as NETBIOS, dNSHostName and failedAttempts are some examples.

Custom discovered system object attributes can be removed by setting the cust-attr-file registry entry of the local service of the workstation to an empty string.

Custom discovered system object attributes can be added by setting the cust-attr-file registry entry of the local service of the workstation to the full path name of the custom attribute file.

The Local Workstation Service can send properties of its installation to the McAfee ePolicy Orchestrator (ePO) via McAfee Agent. These properties include the product version, the installation path, and language version.

The server or workstation on which the Local Workstation Service will be installed must be added as a system on the ePO. Consult the McAfee ePolicy Orchestrator documentation to learn how to do this.

Supported versions of ePO include v4.6 or greater.

To install and configure Local Workstation Service to be ePO aware:

To run the Local Workstation Service installation manually using ePO:

To run the Local Workstation Service installation immediately after adding a new system to the ePO:

To view the properties of the Local Workstation Service on ePO:

To uninstall the Local Workstation Service using ePO: