Trend Micro is offering a migration special for their Deep Security product for current CSA customers. These are the details from their web site: Migration Special First 6 months: “Free Swap”: Until Dec 31 2010, active Cisco CSA customers can receive the same number and type of licenses (desktop vs. server) of Deep Security (Firewall and Deep Packet Inspection modules) plus the Deep Security Manager at no additional license cost, provided that they purchase one or more years of maintenance and support upon the expiry of their current maintenance agreement. Next 18 months: 25% Discount: From Jan 1, 2011 through Jun 30, 2012, active Cisco CSA customers can purchase the same number and type of licenses (desktop vs. server) of Deep Security (Firewall and Deep Packet Inspection modules) plus the Deep Security Manager at a 25% discount off of the list price. I've been testing it and though it doesn't include anti-malware, it does provide a lot of the functionality we used in CSA, though it does it differently. Tom ... View more

It could be this bug which was found in 6.0.2.126 and is not fixed: CSCtg98849 Bug Details CSA: Windows Login Hangs or Takes Excessive Time with CSA Enabled Symptom: Logging into a Windows host can take an excessive amount of time, or result in a black screen with only a mouse pointer visible. Conditions: Windows host is protected by Cisco Security Agent with a default policy associated or any policy that includes the "Base - Basic Application Classification" policy. Workaround: Edit the "Base - Digital Signing of Downloaded Executables" rule module and disable the file access control "Send downloaded executables for scanning if opened for read". Save the change. Generate rules and deploy to affected hosts Tom ... View more

Check your rules to ensure bug CSCtg98849 isn't affecting you. Tom ... View more

Yes, CSA installs several shims and you can see them in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\. They all begin with csa and there would be eight if CSA was installed. If you don't have CSA installed, there is no folder under program files and the services aren't running, I would look elsewhere. Tom ... View more

It should not present a problem to change the MC address and DNS record unless your hosts resolve to an IP address instead of a FQDN. In that case, you'll need to do something else. Tom ... View more

Make sure you have "Show processes from all users" checked and look for the okclient.exe, leventmgr.exe and csacontrol.exe processes. If present, see if leventmgr.exe is consuming lots of resources. ... View more

What about putting the CSAMC in your DMZ and allowing those ports through your firewall? The nice thing is it allows hosts to communicate with the MC no matter where they are. You'd have to open up 80 to the MC for software updates but we haven't had any problems in 6 years with that setup. Tom ... View more

I use user states to allow admin users to do things by using a rule module that applies only to them. Look at the built in user state sets to become familiar with the structure.  If you use AD to define roles, you can create user state sets that include certain AD groups and assign them to rule modules that allow the activities you want them to perform. For example, I have an AD group called AD\ServiceDesk.  I created a user state set called AD Service Desk Members with users matching and groups matching AD\ServiceDesk. I created a rule module that allows activities that are denied by other rule modules and applied the user state set to it. I associated it with the standard Desktop policy that is associated with the group. Any member of that group can do things on any host in the Desktops group but standard users cannot. Tom ... View more

1. User states is how we apply policies based on username no matter which workstation they are logged in to. 2. Bandwidth has rarely been an issue except when agent software updates. Polling intervals can be adjusted for slow sites if this is an issue. 3. This questions is rather broad and it depends on many factors. HTH Tom ... View more

Never seen that one before and I've broken quite a few MCs Is that snippet from the host or the MC?  Are they still registered?  Restarted everything and checked Windows event logs on all? Deployed another agent kit to another host? So many places to look... Tom ... View more

My CSA 5.2 server is also Windows Server 2003 and has MDAC 2.8 SP2 and SQL 2005 installed. I suggest you run the version checker available here: http://www.microsoft.com/downloads/details.aspx?FamilyId=8F0A8DF6-4A21-4B43-BF53-14332EF092C9 The problems may be related if you cannot generate the rules without error. ... View more