Deploying SecureAnywhere to Endpoints



Hello. You have arrived at an outdated topic. Please click this link to be redirected to the updated Endpoint Protection Admin Guide.

You can deploy SecureAnywhere to endpoints using a variety of methods, depending on your business requirements and network size. An endpoint can be a Windows PC, laptop, server, or virtual server installed in your network. A list of endpoint system requirements is provided in Preparing for Setup.
Note: You can configure alerts so that administrators receive notification whenever new endpoints are installed. For more information, see Implementing Alerts.

To deploy SecureAnywhere to endpoints:

  1. Find your keycode. If you don't know your keycode, look in the Resources tab of the Management Portal.



    Note: Devices must use the Endpoint Protection keycode before they can report into the Management Portal. If there are endpoints in your network that already have SecureAnywhere installed with a different keycode, see Changing an Endpoint Keycode.
  2. Select a method of deployment that best suits your environment.
    The following table describes methods of deployment.
    Note: For Mac computers, you will need to manually install SecureAnywhere on each endpoint.
      
    DEPLOYMENT OPTIONDESCRIPTION
    Deploy the SecureAnywhere executable file Deploy the SecureAnywhere installer file using one of these methods:
    • Manually install the executable file on each endpoint.
    • Send emails to end users, so they can install the software by clicking on the link provided in the email template.
    • Rename the executable file using your keycode. The email template also provides a renamed executable file with the keycode.
    • Use additional commands with the executable file to deploy it in the background.
    • Use command-line options with the installer to deploy to endpoints that are behind a proxy server.
    Use MSI deployment options Deploy the SecureAnywhere installer file using the Microsoft Installer (MSI).
    Use Windows Group Policy Object (GPO) Deploy the SecureAnywhere installer file using Group Policy Object (GPO). You should have experience with Microsoft’s Active Directory and the GPO editor.
     
    Note: If you have a small network with less than 100 endpoints, we recommend that you use the simple deployment options described in the Resources tab. If you have a large network and use Active Directory, you should use the advanced deployment options. For large networks, you may also want to organize endpoints into separate consoles for simplified views into smaller groups. For more information, see Adding Consoles to Your Account.
  3. Deploy SecureAnywhere to the endpoints, as described in one of these sections:
    Note: Check the Management Portal to make sure the endpoints have reported their status. For more information, see Viewing Endpoint Status.
  4. Do either of the following:
    • Allow the system to assign endpoints to your default policy and default group. All endpoints are first assigned to your default policy and a default group. You can change those assignments later, if desired. For more information see Implementing Policies and Applying a Policy to Endpoint Groups.
    • Assign endpoints to a specify group by selecting the group you want to add endpoints to, then from the Actions drop-down menu, select Deploy Endpoints to this Group.




      The system displays information required to install the software via the command link, and then adds the endpoint to the selected group.

  5. When you're done, click the OK button.
Using the SecureAnywhere Installer
You can deploy the SecureAnywhere installer file using one of these methods:
  • Install SecureAnywhere on each endpoint. Use this option if installing on a Mac.
  • Send emails to end users, so they can install the software by clicking on the link provided in the email template.
  • Rename the executable file using your keycode. This method is useful if you plan to use your own deployment tool and if you prefer not to use MSI commands to run the installation in the background.
  • Use additional commands with the executable file to deploy it in the background.
  • Use command-line options with the installer to deploy to endpoints that are behind a proxy server.

To use the SecureAnywhere installer for Windows:

  1. On the endpoint, download the SecureAnywhere installer file.
    The installer file is available from the Resources tab or by clicking this link:
  2. In the installation panel, enter the keycode.
    Your keycode is shown in the Resources tab.




  3. Optionally, you can click Change installation options at the bottom of the installation panel and set these options:
    • Create a shortcut to SecureAnywhere on the desktop — This option places a shortcut icon on the Windows Desktop for SecureAnywhere.
    • Randomize the installed filename to bypass certain infections — This option changes the Webroot installation filename to a random name for example, “QrXC251G.exe”, which prevents malware from detecting and blocking Webroot’s installation file.
    • Protect the SecureAnywhere files, processes, and memory from modification — This option enables self protection and the CAPTCHA prompts. CAPTCHA requires you to read distorted text on the screen and enter the text in a field before performing any critical actions.
    • Change Language — To determine the language displayed in SecureAnywhere, click the Change Language button and select from the supported languages. You can only determine the displayed language during installation, not after.
  4. Click Agree and Install.
    During installation, SecureAnywhere runs an immediate scan on the endpoint.

To use the SecureAnywhere installer for Mac:

  1. On the endpoint, download the SecureAnywhere installer file.
    The installer file is available from the Resources tab or by clicking this link:
  2. Download the SecureAnywhere installer to your Mac.
  3. Double-click wsamac.dmg to open the installer.
  4. Open the Applications folder by double-clicking the folder icon.
  5. In the Applications folder, double-click the Webroot SecureAnywhere icon to begin activation.
  6. In the first activation window, select a language from the drop-down box and click Next.
    Note: Make sure you select the desired language. Once SecureAnywhere installs, you cannot change it.




  7. In the next panel, enter your keycode and click the Activate button.



  8. Follow any remaining on-screen prompts to complete the installation.

To send an email to end users so they can install SecureAnywhere themselves:

  1. Click the Resources tab.
  2. Click the Email template link.
    The email template displays in the How to get started window.



  3. Cut and paste the text into an email message. The link automatically adds the correct keycode for the user. Send the email to the users.
    The user clicks the link to begin installation. The program installs silently in the background, with the correct keycode already entered. When the process completes, a Webroot icon displays in the endpoint's system tray.

To run a background installation by renaming the executable file:

You can deploy SecureAnywhere by renaming the executable file with the keycode. This method is useful if you plan to use your own deployment tool and if you prefer not to use MSI commands to run the installation in the background. You can also use the email template, as described above, which is preconfigured to include a renamed installer file with your keycode.
 
Note: In User Account Control environments, the account used to run the installer must have local admin rights. You must run the installer from a process that has elevated privileges in UAC environments, to prevent the end user from seeing a UAC prompt.
  1. On the endpoint, download the SecureAnywhere installer file:
  2. Rename the installer file by replacing wsasme with your keycode.
    The resulting file name will have this format: XXXX-XXXX-XXXX-XXXX-XXXX.exe
  3. Install the SecureAnywhere software on your endpoints, using your own deployment tool.

To run a background installation from a command line:

  1. On the endpoint, download the SecureAnywhere installer file:
  2. Run the installer from a command line, using any of the command options listed in the following table. More options are available; contact Webroot Business Support for more information.
    COMMAND LINEDESCRIPTION
    /key=keycode Installs with the provided keycode, with or without hyphens. For example: wsasme.exe/key=xxxx-xxxx-xxxx-xxxx-xxxx
    /silent  Installs in the background.
    /nostart  Installs without starting SecureAnywhere.
    /lockautouninstall=password  Allows automatic uninstallation of SecureAnywhere using the password you specify. This option is useful if you need to silently uninstall SecureAnywhere later. To uninstall, use the /autouninstall command.

    When you use /lockautouninstall, SecureAnywhere is not included in the Add/Remove Programs list in the Control Panel. Use the /exeshowaddremove command to include SecureAnywhere in Add/Remove Programs.
    /autouninstall=password Corresponds to /lockautouninstall. Example: wsasme.exe/autouninstall=password

    By default, SecureAnywhere does not appear in the Add/Remove Programs list in the Control Panel, which prevents the user from removing the software in unmanaged mode.
    -clone

    For cloned machines/VMs use this to have the agent create a persistent, unique value on the PC which will change what is displayed in the portal for the machine IDs and the hostname of the PC.

    The product log will indicate this flag being present for the administrator to be aware of which PC they're looking at, for example "Applied unique machine ID: C8137921" where C8137921 matches the hostname, for example, PCHOSTNAME-C8137921, as well as the first 8 bytes of both the InstanceMID and DeviceMID to allow each of them to be identifiable and different than the original IDs.

    This value will persist if the agent is uninstalled/reinstalled so that existing agents won't move to other IDs. If the OS is reinstalled, the ID will change.

    Example: wsasme.exe /key=xxxx-xxxx-xxxx-xxxx-xxxx /silent -clone 

    Note: For use when InstanceMID's are matching causing duplicates in the console or endpoints replacing endpoints at each poll interval.
    /exeshowaddremove

    Includes SecureAnywhere in the Control Panel Add/Remove Programs list.
    Example: wsasme.exe /key=xxxx-xxxx-xxxx-xxxx /lockautouninstall=password/exeshowaddremove

    Note: Adding SecureAnywhere to Add/Remove Programs enables the endpoint user to remove the software in unmanaged mode.
    /group=groupcode

    Command line switch for deploying directly into groups.

    Example:

    wsasme.exe /key=xxxxxxxxx /group=-135260017840748808 /silent

    Assign endpoints to a specific group by selecting the group you want to add endpoints to, then from the Actions drop-down menu, select Deploy Endpoints to this Group. Note the GROUPCODE.

    Other requirements:

    • The group must already exist in the console.
    • This only works new for new installs on systems that have never been seen by the console previously.
    Example for command line:  msiexec /i "C:\wsasme.msi" GUILIC="XXXX-XXXX-XXXX-XXXX" CMDLINE="SME,quiet,Group=-135260017840748808" /qn /l*v %windir%\wsa_install_log.txt

    For MSI installs you can use command line and an MSI editor.

    Example for MSI Editor in CMDLINE field: Group=-135260017840748808
    -proxyhost=X -proxyport=X -proxyuser=X -proxypass=X -proxyauth=#

    Specifies proxy settings. 

    Note: If the endpoint connects through a proxy server, SecureAnywhere will automatically detect the proxy settings. SecureAnywhere checks for changes to the proxy settings every 15 minutes and when the endpoint restarts. We recommend using auto-detection for proxy settings; however, you can use command-line options if you prefer.


    To enable proxy support, use these command-line options: wsasme.exe -proxyhost=nn.nn.nn.nn -proxyauth=n (where n can be 0=Any, 1=Basic, 2=Digest, 3=Negotiate, 4=NTLM) -proxyuser=proxyuser -proxypass=password -proxyport=port_number

    We recommend that you use a specific value for-proxyauth, instead of 0 (any). The any option requires the endpoint to search through all authentication types, which might result in unnecessary errors on proxy servers as well as delayed communications.

    If you use this command-line option, use all parameters and blank out any value you don't need with double quotes, for example: proxypass=""
     /lang=LanguageCode

    Specifies the language to use for the product, rather than allow default language detection. Codes include:

    en = English
    ja = Japanese
    es = Spanish
    fr = French
    de = German
    it = Italian
    nl = Dutch
    ko = Korean
    zh-cn = Simplified Chinese
    pt = Brazilian Portuguese
    ru = Russian
    tr = Turkish
    zh-tw = Traditional Chinese

    Example: wsasme.exe /key=xxxxxxxxxxxx /silent /lang=ru
Using MSI for Deployment
The Microsoft Installer (MSI) requires commands during installation, which apply the keycode and options that activate Endpoint Protection installation mode. The MSI installer is interactive by default, and requires the msiexec.exe option /qn to run an automated installation in the background.
This is an example of an MSI command:
msiexec /i wsasme.msi GUILIC=licensekey CMDLINE=SME,quiet /qn /l*v install.log
 
Note: In User Account Control environments, the account used to run the installer must have local admin rights. You must run the installer from a process that has elevated privileges in UAC environments, to prevent the endpoint user from seeing a UAC prompt.

To remove SecureAnywhere later:

To remove the SecureAnywhere software from the endpoint later, use the standard MSI command:

msiexec /x wsasme.msi /qn /L*v uninstall.log

To use an MSI editor:

If you use your own methods to deploy the SecureAnywhere software on endpoints, see the following table for commands you can pass to msiexec.exe during installation.
COMMANDDESCRIPTION
CMDLINE SME,quiet
GUILIC

The license key, with or without hyphens.

Note: If you don't provide a keycode, the installation will continue; however, the endpoint will not have a keycode associated with it and will not be protected. If you install without a keycode, you must uninstall the software and re-install to add it.
ARPNOREMOVE To prevent the uninstallation by end users
You can also modify these commands directly, using an MSI editor such as ORCA:
  • Set the CMDLINE property in the Property table to the appropriate value.
  • Set the GUILIC property in the Property table to your keycode.
  • Set the ARPNOREMOVE property in the Property table to the appropriate value.
Using GPO for Deployment
To install SecureAnywhere using GPO, you should have experience with Microsoft’s Active Directory and the GPO editor.
You can also watch a video for using GPO at: How to Deploy Using Group Policy - Webroot SecureAnywhere Business.

To install SecureAnywhere using GPO:

  1. From the following location, download the SecureAnywhere MSI installer to a network share:
    Downloading the file makes it accessible to all endpoints on which you will deploy SecureAnywhere.
  2. Go to the server that is the domain controller for the deployment group.
  3. Open the GPO editor on the domain controller and create a policy for the deployment group.
  4. Assign SecureAnywhere to all endpoints that belong to the Organizational Unit where the Group Policy is created.
    SecureAnywhere installs on the endpoints in the group when they restart.
 
Installer Options

The WSA agent comes in two installer formats, EXE and MSI, both of which are located under the Resources tab in your WSA console.

  • EXE — The EXE file format can be downloaded and installed either using the generic EXE file, wsasme.exe, or by using the Windows Download link, which is the EXE file, renamed using your WSA keycode, which when run, imbeds the keycode into the installation process, and runs as a silent and unattended installation.
  • MSI — The MSI format can be downloaded utilizing the wsasme.msi link under the Install using MSI section. The MSI can be edited to customize the installation including the keycode in the GUILIC property and Command-Line options in the CMDLINE property and be deployed using GPO. A video here outlines that process.

Installing on Terminal (RDS) Servers and Citrix XenApp

When installed on a Terminal server (RDS server) or Citrix XenApp for desktop/session brokering or hosted shared desktops, the WSA agent protects the environment by sharing its kernel module across sessions and provides a user process for each. The Webroot Management console shows the hosting server and each session as a combined single entry or device for reporting and management. The WSA agent does not support being streamed via application virtualization.

Installing on Duplicated Images or VMs  

When Webroot SecureAnywhere Business Endpoint protection is installed a ‘machine ID’ is generated from various hardware and software data points including Hostname, SID and MAC address. If endpoint images are re-used without ‘sys prepping’ them, or in virtual environments where VMs are copied or provisioned from a master image and not sys prepped as part of their deployment or provisioning, the endpoints will report into the console using the same ‘machine ID’ and compete for the same position or potentially generate duplicates in the Webroot management console.

If this occurs in your Webroot management console, please uninstall Webroot SecureAnywhere Business Endpoint Protection from the affected endpoints Be sure to remove or rename the folder “WRDATA” located in %PROGRAMDATA% to ensure no configuration files remain, then, reinstall it with the “uniquedevice” command line option

For example:

Executable Method

“wsasme.exe /key=xxxx-xxxx-xxxx-xxxx-xxxx /silent –uniquedevice”

MSI Method

CMDLINE -uniquedevice
This will cause SecureAnywhere to create a unique identification for that system by taking a checksum of the hostname and modifying the ‘machine ID’ with it. This is useful if the machines OS or hardware are cloned but the hostnames are always different. In this case, the unique hostname will allow there to be unique instances of devices for reporting into the Webroot management console. The hostname remains untouched so it will be reported into the console exactly as it exists within the OS.  

For this reason it is not recommended to install Webroot SecureAnywhere Business Endpoint protection within an image that will be copied or used for provisioning without first being sys prepped. In most virtual environments Webroot SecureAnywhere Business Endpoint protection should be installed after the VM has been deployed using Group policy or logon script, etc including non-persistent VM environments.

If hostnames are not unique within the deployment the “clone” install switch should be used. For example:

Executable Method

“wsasme.exe /key=xxxx-xxxx-xxxx-xxxx-xxxx /silent –clone”

MSI Method

CMDLINE -clone
This creates a registry key stored in: HKLM\System\CurrentControlSet\Control\CloneTimeStampFlags

Use this to have the agent create a persistent, unique value on the PC which will change what is displayed in the portal for the machine IDs and the hostname of the PC.

The scan log will indicate this flag being present for the administrator to be aware of which PC they're looking at, for example:

"Applied unique machine ID: C8137921"

where C8137921 matches the hostname reported in the Webroot management console, for example, PCHOSTNAME-C8137921. This value will persist if the agent is uninstalled/reinstalled so that existing agents won't move to other IDs. If the OS is reinstalled, the ID will change.

For more information on how to deploy within a Citrix environment specifically, please see this document:

http://download.webroot.com/Citrix/Citrix.pdf