Jon's Network » BigFix

BigFix Installation Notes

Jon — Tue, 19 Jan 2010 23:55:11 +0000

BigFix Guides

Deployment Guide

User Guide

Admin Guide

BigFix Network Traffic Guide

BigFix Server Hardware/Software Specifications

BigFix Server Requirements

Provision a dedicated server or virtual image with at least 20 GB of free disk space and 2 GB of RAM
Perform a clean install of a Microsoft Windows Server 2003 | 2008 with all critical patches and Service Packs applied
Install a default instance of Microsoft SQL Server (Standard or Enterprise) locally on the server. If you do not have a license for SQL server, download and install the free 6 month evaluation version from Microsoft.

Network Specifications

Allow the BigFix server to have direct Internet access without going through a proxy.
Allow TCP and UDP traffic on port 52311(default) across any internal firewalls and centrally managed personal firewalls.
Define and propagate an internal DNS entry for the BigFix server so its IP address can be resolved through a fully qualified domain name, for example: bigfix.OrganizationName.TopLevelDomain. If a DNS name is not used, the BigFix server must have a fixed IP address.

Other than applying all relevant patches to the Server OS, also download and install the following software as well prior to our meeting:

BigFix Software Download

BigFix Enterprise Suite is located here (get the evaluation version unless you have received a license already).

If we have a WebEx scheduled for the installation, just download the installer to the server and reboot the machine prior to the meeting.

Installing the BigFix Agent

A complete list of options can be found in the BES System Administrator’s Guide.

For environments with no existing software deployment methods (GPO, login scripts,etc.), the BigFix Deployment Tool may work. For the BigFix Deployment tool, it is important that you are able to meet the requirements outlined at this BigFix KB article.

Using the BigFix Deployment tool to install the BigFix Client to workgroup or domain computers requires the following configuration only during the period of agent installation:

RPC must be enabled
File and print sharing must be enabled
Any local firewalls on the endpoint must be disabled

If you have problems with the deployment tool, it is usually because of one of the following reasons:

RPC is not enabled
File and Print Sharing is not enabled
A personal firewall or other endpoint security tool is blocking the connection (AV, HIPS, etc.)
An internal firewall is blocking the connection
The person using the Deployment tool does not have the correct domain permissions to remotely install software; or, if they are using a local administrative account, they do not have the correct local administrative password

Installing the BigFix Client with MSI

You can use the Microsoft Installer (MSI) version of the BES Client to interpret the package and perform the installation automatically. This MSI version of the client (BESClientMSI.msi) is stored in the BESInstallers\ClientMSI folder. You can run this program directly to install the client or you can call it with arguments. Here are some sample commands, assuming that the MSI version of the Client is in the C:\BESInstallers\ClientMSI folder: msiexec.exe /i c:\BESInstallers\ClientMSI\BESClientMSI.msi /qn

The \qn command performs a silent install. msiexec.exe /i c:\BESInstallers\ClientMSI\BESClientMSI.msi INSTALLDIR="c:\myclient"

This command will install the program to the given directory. You can find the full list of installation options at this Microsoft site.

With the MSI version of the client installer, you can create a Group Policy Object (GPO) for BESClientMSI deployments. For more information on Group Policies, see the Microsoft knowledge base article 887405.

Installing the BigFix Agent on Macs

Installation instructions for the Mac BigFix Agent are here. You may want to use the Apple Remote Desktop feature to automate the delivery.

BigFix Asset Management

Jon — Wed, 09 Dec 2009 21:49:54 +0000

Here is a short podcast on the strategy behind BigFix’s software asset management solution:

How BigFix DSS-SAM Changes the Game of Software Asset Management

According to BigFix research, most organizations overpay for software licenses that they aren’t using. An easy way to save 10-15% off the top of software licensing costs is to use a solution that tracks your assets in real time with useful analytics that you can trust. The flip side to this is that you can also prove you are buying enough licenses which helps when you are audited by your software vendor.

If you are still using spreadsheets to track assets or don’t trust the results of your current asset management software, you may want to try out BigFix.

BigFix Power Management

Jon — Mon, 27 Apr 2009 06:09:54 +0000

Offered as a stand-alone product or as part of the BigFix Systems Lifecycle Management suite, BigFix Power Management allows IT organizations to enforce conservation policies across the enterprise, while providing granularity that enables application of these policies to a single computer. For end users, BigFix Power Management maximizes power policy deployment while minimizing usage impact through an optional â€œopt-inâ€ approach. Granular controls also allow end users to save their work before shutting the system down – ensuring no loss to productivity. (Link: BigFix)

Centralized, policy-driven power management of distributed computers scalable from individual machines to entire global enterprises
Fine-grained controls for hibernation/ standby, subsystem-only shut down and “save work before shutdown” options
Wake-On-LAN support synchronizes systems maintenance processes with power conservation
“Opt-in” programs encourage end-user participation as well as “Wake-on-Web” feature to allow for end-users to remotely connect and turn on their own systems

BigFix

Jon — Mon, 27 Apr 2009 04:46:37 +0000

BigFix gives you an intelligent, non-invasive client to do pretty much anything you can think of when trying to manage disparate machines spread out all over the world. If you have problems finding your machines, changing anything on your machines, or maintaining and verifying configurations, you should take a look at BigFix.

The BigFix platform is designed to continuously discover, assess, remediate, and enforce the health and security of servers, desktops, and roaming laptops in real-time via a single, policy-driven agent and single console. (Link: BigFix)

Beyond the Perimeter

Jon — Mon, 09 Mar 2009 23:14:50 +0000

New podcast by Amrit Williams of BigFix

BigFix ahead of Sophos

Jon — Fri, 07 Mar 2008 06:43:27 +0000

I’ve been watching (and selling) Sophos for years. It has become even easier to sell in the past 12 months simply by showing CA or McAfee customers the Sophos management console. Most see pretty quickly how much time it will save them. Sophos’ strategy seems to resonate as well: do more with less. With the same console and agent they have anti-malware, application control, HIPS and client firewall. Still, there are things that are yet lacking: integrated NAC, device control, DLP. All three of these will be released in the next 12 months. But what about software inventory, vulnerability assessment, and patch management? I mentioned this stuff a year ago and I still suspect they want it. Maybe they will buy Lumension “Secure Link” or Bit9 to get it at it.

I’ve recently done some research into BigFix. I can’t help but announce that they do more with less – better. What Sophos does quite well in the scope of anti-threat and application control, BigFix does with hardware and software asset discovery, software license inventory and usage metering, software distribution, patching/remediation, OS provisioning, software configuration management, vulnerability management, DLP, NAC…and anti-malware.

I know the idea of using a superagent on the desktop bothers Hoff but

robust protocols, strong mutual authentication, encryption, resilient operating systems and applications that don’t suck

are just a pipe dream right now. Master-agents are the way to go and it looks to me like BigFix has an easy lead. The whole fixlet idea combined with their architecture is pretty much a platform to do whatever the hell you want as far as controlling your endpoints goes – regardless of location.

Yep. More with less.