Product Reviews

The proliferation of viruses over the past few months means that it's now sheer folly not to have anti-virus software installed and regularly updated. Personal users have an easier time as they only have to worry about protecting one or two PCs, but network administrators have to look after hundreds or thousands of workstations.

Symantec's Norton AntiVirus Corporate Edition aims to deliver full network protection for servers and desktops along with centralised management from a single main console. This latest version brings improved network discovery tools, client support for Windows ME and XP, compatibility with Windows 2000 Terminal Services and an alert filtering capability for virus warnings.

At the top of the hierarchy is System Center 4.6, which provides a central console from where a variety of Symantec anti-virus products can be managed. It's installed as an MMC (Microsoft Management Console) snap-in, and you add further modules depending on which product you wish to manage - in this case, the Norton AntiVirus snap-in. Below this, you arrange your anti-virus servers depending on how you want to manage your clients. You could, for example, define your groups to represent departments and offices, allowing different settings to be deployed easily to specific users. Each server group requires a primary server, which manages the configuration and tasks for that group and can be used to deliver new signature updates. On smaller sites, the primary server could be used to look after all your client systems, but larger networks will want to split this task up among secondary servers to reduce the workload.

Selecting a group from the System Center console displays all the servers contained within, and you can drill down to individual systems to see which clients they're managing. System Center can populate the groups automatically, as it runs a network discovery routine over both IP and IPX each time it loads.

Local protection for servers and clients is handled by the network version of Norton AntiVirus. This can be deployed from the System Center console using a disk image on a server or a login script. A real-time scanner is permanently loaded in the background, and takes its instructions from the primary or secondary server. You can force a scan every time a file is created, modified, downloaded, moved or copied, and allow it to repair a file if an infection is spotted. A useful feature is the option to take a backup of a file before the repair is attempted. If a repair fails, the file can be removed from the client and sent to a Quarantine server where it can be dealt with later. This requires another MMC snap-in before it can be managed from the System Center.

Deploying scanning rules to multiple systems is simple, as you right-click on a group or server and select either the server or client real-time scan options. Make your choices, and these will be automatically sent to the relevant systems. You can decide whether an icon is displayed in the client's System Tray, lock out attempts to unload or uninstall the software and request a password before a user can scan a network drive. Regular scans of selected clients can be scheduled from the System Center, and you can also run on-demand scans.

New virus signature files are easily distributed as Symantec provides a VDTM (virus definitions transport method), which pushes new definition files to clients. LiveUpdate is another delivery method that reduces network traffic during an update, as a central server is used to download updates regularly from Symantec's Web site. When clients log on to the server, they're scanned and will only receive parts of the file that they don't already have. Alerting is impressive, as Symantec has integrated Intel's AMS2 system, which comes from its LANDesk Management Suite (see enterprise, issue 82, p234). AMS2 keeps you in touch with the action in a variety of ways since it sends out warnings if viral activity is detected or if any problems with the anti-virus software itself are identified.

Although Norton AntiVirus Corporate Edition is more complex than Sophos Anti-Virus (see Reviews, issue 88, p178), it's easy to install and manage. Placing servers and clients into customisable groups simplifies software deployment and allows administrators to enforce anti-virus policies across the network.

Dave Mitchell