Using embedded database

[rickdemps]

Admin guide not very helpful when selecting a database type. Is there any info on how many clients are supported using the embedded database?

 

Thank you.

[gonzo]

That information is in the Best Practices Guide:

 

http://static-cdn.malwarebytes.org/assets/userguides/2014-09-08/MBMCBP.pdf

 

It will also be in the Quick Start Guide, once I am done writing it.

 

The number of clients can't be specifically nailed down.  An office full of accountants won't cause near as many threats or data logging as a dorm room full of college students.

[rickdemps]

Thank you for the info. What about MSSQL 2012?

[gonzo]

It hasn't been officially tested yet, so the answer has to be "officially" no until we know ourselves.

[rickdemps]

Thank you, this has be very helpful. Couple more questions.

 

-Can the database reside on a remote server

-Under 'Pre-Installation' Tasks\Active Directory.'  If I have more than 1000 computers in an OU structure, can I still use malwarebytes?

 

thank you

[gonzo]

The database can be on the same server, or on a different one...as long as it is accessible on the local network.

 

You would have to drill down into your OU structure rather than trying to pull all at once.  Microsoft has specified that only 1000 entries can be included in response to a LDAP query.  You can't do a second query to get the next batch.  If you look around, you can find out how to increase that number, BUT they did that to prevent DoS attacks.  If you change it, you do so at your own risk.  Otherwise, drill down so that the maximum number of computers returned in a query is less than 1000.

[rickdemps]

Hi again Michael-

 

So the short answer is yes, I can manage more than 1k systems in a single OU using Malwarebytes for business?

 

-rick

[gonzo]

Yes, but you still must employ a workaround due to the 1k limitation.

[rickdemps]

I thought this was just due to deploying the clients?

[gonzo]

First, you ARE speaking of managed mode (Management Console installing Anti-Malware) as compared to unmanaged mode (standalone Anti-Malware), aren't you?

 

IF you are speaking about using Management Console, you must be able to do a discovery of all computers that you wish to install a client on.  If you're doing it based on AD OU's, the 1K limitation applies.  Once you have discovered the computer, you can do a client install on the computer.  If you want to a discovery based on OU's again later on (maybe to look for newly-installed computers), the 1K limitation applies then as well.

[rickdemps]

I think were talking about two things, install and management.

 

For installing-  I can use a standalone installer or deploy from a third party tool such as Dell KACE?

 

For management, I can have any number of clients in the management server. I did a POC well over a year ago and if I recall, I separated into their own groups on the management server if I wanted.

 

Does that sound right? Sorry be being a frustration...

[gonzo]

That sounds right.

[rickdemps]

Thanks again, and to be clear, for cliednt management, I can have more than 1000 clients on the management server? Thank you.

[gonzo]

You CAN have more than 1000 clients on the management server.  Admins will typically discover ALL of their clients with a single discovery, but you can only discover a maximum of 1000 clients unless you (a) modify Active Directory to allow more than 1000 clients to be returned in an LDAP query, or (b) perform multiple discoveries at a lower level in your OU tree so that you return less than 1000 computers with each query.  Once your discovery is complete, you can perform client installations using Management Console or by an alternate installation process of your choosing.  Only discovery is limited by the 1000 client cap.  Neither installation or subsequent management is limited by that cap, only discovery.