Web Endpoint deployment overview

Web Security Help | Web Security Solutions | Version 7.8.x

Manually deploying Web Endpoint for Windows

Manually deploying Web Endpoint for Mac OS X

Websense Web Endpoint is a piece of software that gets installed on a client machine. It enforces the use of the hybrid service for Web Security, and passes authentication information to the hybrid proxies, enabling secure transparent authentication.

For an up-to-date list of supported operating systems, see the System requirements topic in the Web Endpoints paper.

To deploy Web Endpoint to Windows clients, you can:

Download the installation files, then use a Microsoft Group Policy Object or similar distribution tool to deploy the files to selected client machines.

Download or copy the installation files onto a client machine, then manually install the Web Endpoint software.

Deploy the endpoint to some or all of your hybrid users directly from the hybrid service. Each user is prompted to install the endpoint software on their machine.

This deployment method is not supported with Google Chrome browsers.

On Internet Explorer 10, this deployment method is supported only when the browser is in desktop mode.

If a user does not install the endpoint, he or she is authenticated according to the options you have selected on the User Identification page. Single sign-on, available beginning with 7.8.4, is used if configured; otherwise the hybrid service will use the other identification or authentication options you have selected, or finally basic authentication. The user is again asked to install the endpoint next time they start a browsing session.

See Manually deploying Web Endpoint for Windows.

To deploy Web Endpoint to Mac OS X clients, you can:

Download or copy the files onto individual client machines, then launch the installer by double-clicking the package.

Download or copy the files onto a Mac machine, then use Apple Remote Desktop software to distribute the installation package.

See Manually deploying Web Endpoint for Mac OS X.

If you also have a Data Security solution and want to deploy both the Web Endpoint and the Data Endpoint to client machines, you must use the Websense Endpoint Package Builder to create a deployment package for both endpoints. See Installing and Deploying Websense Endpoints in the Deployment and Installation Center.

The endpoint has a number of key protections against tampering, which should prevent the majority of end users uninstalling or deleting the endpoint even if they have local administrator rights.

Endpoint files and folders are protected from being deleted or renamed.

The endpoint process will automatically restart if it is stopped or killed.

A password is required to uninstall the endpoint or stop the endpoint service.

Endpoint registry settings cannot be modified or deleted.

The Service Control command to delete the endpoint service is blocked.

You must define an anti-tampering password to be used to stop the endpoint service or uninstall the endpoint before you can download the installation file or enable deployment from the hybrid service. The password is automatically linked to any deployments of the endpoint.


	Important For security reasons, Websense does not retain a copy of your anti-tampering password. If you forget your password, you can reset it on the Hybrid User Identification page by entering and confirming a new password. All installed endpoints will be updated to use the new password next time they connect to the Internet.

To enable Web Endpoint deployment:

On the Settings > Hybrid Configuration > Hybrid User Identification page, mark Enable installation and update of Web Endpoint on client machines.

Selecting this option allows you to configure Web Endpoint deployment and automatic update settings. If you later deselect this option, any installed endpoint clients continue to work until they are uninstalled, though they no longer receive automatic updates.

Enter and confirm your anti-tampering password. The password must be between 4 and 25 characters.

Select a deployment method:

Click Deploy Web Endpoint Manually if you want to install Web Endpoint by hand on individual machines or via your preferred distribution method. (This is the only option available for the Mac version of the Web Endpoint.)

Note the WSCONTEXT value displayed on screen. If you plan to use GPO to distribute the endpoint, you will use this value in your deployment script to ensure that Web Endpoint users are correctly associated with your organization. See Manually deploying Web Endpoint for Windows.

Click View Web Endpoint Files to view the endpoint versions suitable for your client machines. Select a client operating system, then click on a version of the endpoint to download. You can also view a PDF of the release notes for each version by clicking a release notes link. Click Close when done.

To deploy the endpoint directly to Windows clients from the hybrid service, mark Deploy Web Endpoint from hybrid service proxies.

Choose whether the endpoint is deployed to all users that are filtered through the hybrid service, or only to off-site users.

You can provide a customized message that appears to end users at the beginning of the endpoint download and installation process. The message can be used to reassure the user that the download is company-approved, and to provide any further information they may need. To customize the message, click Advanced Settings, then enter your organization name and the message you want to display. Click View Sample Page to see what will appear to the end user.

The sample page also contains the default text that is always displayed to the end user at the beginning of the download.

Mark Automatically update endpoint installations when a new version is released if you want to ensure that all endpoints on your client machines always have the latest version when it is available from the hybrid service.

Click OK to cache your changes. Changes are not implemented until you click Save and Deploy.