Appendix
Disabling the Anti-Malware Periodic Scan
"Anti-Malware A component on Endpoint Security Windows clients. This component protects clients from known and unknown viruses, worms, Trojan horses, adware, and keystroke loggers. Scan Storms" can occur when anti-virus scans run at the same time on multiple virtual machines on the same physical server.
A degradation of system performance is possible that can affect disk I/O and CPU usage.
We recommend that you disable the Anti-Malware periodic scan in one of these ways:
![Closed](transparent.gif)
-
Go to the Policy Page.
-
In the right pane, click Web & Files Protection.
-
In the Perform periodic scan every field, select Never.
-
Click Save.
-
Install policy.
![Closed](transparent.gif)
-
In the Select action field, select Perform periodic anti-malware can every month.
-
Clear the "Perform Periodic Scan option.
-
Install policy.
![Closed](transparent.gif)
-
Connect with the Database Tool (GuiDBEdit Tool) (sk13009) to the Endpoint Security Management Server
A Security Management Server that manages your Endpoint Security environment. Includes the Endpoint Security policy management and databases. It communicates with endpoint clients to update their components, policies, and protection data..
-
Configure the value
false
for the attributeenable_schedular_scan
.
![Closed](transparent.gif)
-
In Windows Registry, configure the value
0x0b
for theAVSchedOf
key:-
On 64-bit operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\CheckPoint\EndPoint Security\Anti-Malware\AVSchedOf=(DWORD)0x0b
-
On 32-bit operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\EndPoint Security\Anti-Malware\AVSchedOf=(DWORD)0x0b
-
-
Restart the machine to restore Self-Protection.
Use the Compliance
Check Point Software Blade on a Management Server to view and apply the Security Best Practices to the managed Security Gateways. This Software Blade includes a library of Check Point-defined Security Best Practices to use as a baseline for good Security Gateway and Policy configuration. Software Blade
Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities. to change the registry. See sk132932.
Advanced Settings for Persistent Desktops
This section shows how to configure clients manually for the Persistent VDI solution.
Use this approach if the "Policy Approach" is not available.
-
Disable the Anti-Malware Periodic Scan. See the instructions above.
-
If you cannot disable the Anti-Malware Periodic Scan, then enable the Anti-Malware Randomized Scan:
-
Connect with the Database Tool (GuiDBEdit Tool) (sk13009) to the Endpoint Security Management Server
Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server..
-
Configure the value
true
for the attributeenable_randomized_scan
. -
Configure the value
true
for the attributeenable_schedular_scan
. -
Configure the applicable value for the attribute
scan_interval
.
-
-
In SmartEndpoint, install policy.
Advanced Settings Non-Persistent Desktops
This section shows how to configure clients manually for the Non-Persistent VDI solution in the Signature Server and Signature Server Consumers roles.
Use this approach if the "Policy Approach" is not available.
Configuring the Shared Signatures Server
You can configure the Signature Server manually or with a script.
![Closed](transparent.gif)
Create a Shared Folder
-
Create a folder to store the shared signatures.
-
Share the folder and grant read access to members of the Domain Computers' group.
|
Note - On Workgroup machines, the "SYSTEM" account does not have network login rights. This configuration is not supported. |
Configure the Windows Registry Keys
-
Configure the value
0x01
for the keyVdiSignatureServer
(to configure the machine as "Shared Signatures Server"):-
On 64-bit operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CheckPoint\Endpoint Security\Anti-Malware\VdiSignatureServer=(DWORD)0x01
-
On 32-bit operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\Endpoint Security\Anti-Malware\VdiSignatureServer=(DWORD)0x01
-
-
Configure the path to the shared signatures folder in the key
AVSharedBases
:-
On 64-bit operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CheckPoint\Endpoint Security\Anti-Malware\AVSharedBases=(SZ)"DISK:\\Path\\To\\Shared\\Folder"
-
On 32-bit operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\Endpoint Security\Anti-Malware\AVSharedBases=(SZ)"DISK:\\Path\\To\\Shared\\Folder"
Notes:
-
If you do not configure the path, then the default shared folder is:
C:\ProgramData\CheckPoint\Endpoint Security\Anti-Malware\bases\shared
-
The default shared folder exists after the first successful update.
-
-
Reboot the machine to restart the Anti-Malware blade.
![Closed](transparent.gif)
-
Download the Shared Signatures Server Configuration script file.
-
Execute the script on the Signature Server and follow the instructions.
-
Make sure the script finishes successfully.
-
Make sure you reboot the machine to restart the Anti-Malware blade.
Configuring the Client Machine
You can configure the Client Machine (the Golden Image) manually or with a script.
![Closed](transparent.gif)
-
Disable the Anti-Malware Periodic Scan. See the instructions above.
-
In Windows Registry, configure the value
0x01
for the keyAVBasesScheme
(to enable the "Shared Signatures" scheme):-
On 64-bit operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CheckPoint\Endpoint Security\Anti-Malware\AVBasesScheme=(DWORD)0x01
-
On 32-bit operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\Endpoint Security\Anti-Malware\AVBasesScheme=(DWORD)0x01
-
-
In Windows Registry, configure the path to the shared signatures folder in the key
AVSharedBases
:-
On 64-bit operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CheckPoint\Endpoint Security\Anti-Malware\AVSharedBases=(SZ)"\\Server\FolderWithSharedSignatures"
-
On 32-bit operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\Endpoint Security\Anti-Malware\AVSharedBases=(SZ)"\\Server\FolderWithSharedSignatures"
Notes:
-
If you do not configure the path, then the default shared folder is:
C:\ProgramData\CheckPoint\EndpointSecurity\Anti-Malware\bases\shared
-
The default shared folder exists after the first successful update.
-
-
Reboot the machine or restart the Anti-Malware process.
![Closed](transparent.gif)
-
Download the Golden Image Configuration script file.
-
Execute the script on the Golden Image and follow the instructions.
-
Make sure the machine is rebooted.