roga

It was from this post by MartinK of ESET Staff:

I'm guessing that my problem is caused by the unusual version of agent (6.3.177.0) I'm using. What i have decided to do is run as a "server task", i.e. the same task to deploy agent that is used with unmanaged machines. The small number of client machines I have tested this on so far have worked OK, so I guess this is the least worst way of doing it.

Thanks MichalJ As far as I can tell Agent and Server policy are set to AUTOSELECT, however I don't know if there is an easy way to query this - I had a look at the applied policies for a sample computer, but is there a more efficient way? I am trying to upgrade Agent 6.3.177.0 - we rolled back from 6.4 due to 6.4 creating files in Crypto directory. I got the details for 6.3.177.0 from a question in this forum. I have manually upgraded the ERA server with the installer batch file, but it doesn't seem to want to upgrade the client machines after I have done this.

How about a task called "update agent" and another called "update ERA".

Thanks So my original question remains, I used the recommended procedure and it didn't work, I have 2 other ESET sites to deal with, how do I get it working: copying a batch file or using GPO is NOT what I want to do.

So is there a way to update agent via client tasks?

I have ERA 6.5 I had a number of windows servers with EFS 6.5 and an older agent. My understanding was that I can upgrade the agent via a client task: "Remote Administrator Components Upgrade" I set such a task and ERA console showed that the task was complete, however the version on the clients remained at 6.3 In the end at this site I ended up creating an update batch file, which I then ran by other means, this worked and the and ERA Agent is now at 6.5 I have 2 other customers with a similar scenario so before I start on them can you please advise: Am I correct that "Remote Administrator Components Upgrade" is meant to upgrade agent on clients, and if so why do you think it didn't work in this case? regards Roga

So the short answer to the problem of ERAAgent creating unnecessary files in C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 is to uninstall ERAAgent 6.4 and install ERAAgent 6.3 Having now had to deal with this on 3 windows domains I thought I would do a write up of my experiences. NB so far all of the domains which I upgraded to 6.4 have suffered the same problems. 1) All of the clients I have looked at with ERAAgent 6.4 have thousands of files under C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18. The default setting on ERA Server is for agent to report every 60 seconds, so that is 1440 times a day the files are created, over 40,000 a month. 2) It is not always possible to know which of the files can be moved or deleted from Crypto\RSA\S-1-5-18 - on some machines essential services will have necessary files in that directory. 3) Trying to access Crypto\RSA\S-1-5-18 may cause a change in permissions, i.e. windows replacing the default permissions with permissions for the current user account. This created problems later on. NB the permissions on that directory are not the same for all hosts, the permissions on a particular host will depend on the services installed. Problems caused by changing permissions on Crypto\RSA\S-1-5-18 impacted the following services (i.e. caused failures or problems): EraAgent MS SQL Server Remote Desktop Licensing server IIS 4) After replacing ERAAgent 6.4 with 6.3 duplicate entries occurred in ERA console, which needed trimming. Conclusion The upgrade to 6.4 has caused me a lot of extra work, I have thousands of junk files on the computers under my care, which I am reluctant to delete as there is no clear way of identifying them. I also had to troubleshoot a number of problems with other services, which I now know were as a result of permission changes. In one of the earlier posts above MartinK wrote that "There is currently no known workaround", well there is which is to roll back to an earlier version of ERAAgent. If this was said at the beginning it would have saved me some time. In the mean time have ESET changed or withdrawn the problem version of ERAAgent? Or is this software with a known problem still being distributed?

So how can I install agent 6.3? I assume the generated bat file downloads the most recent agent, and of course the machine with the problem is the ERA server so I would also need to install 6.3 on that. I need to sort this ASAP as clearly is causing me problems

The problem only started for me with 6.4, is the problem with the agent or the server? e.g. could we uninstall latest agent and install a previous version until the problem is solved? Or would we have to roll back server, but e.g. keep latest clients?

I'm not sure it is safe to delete all of the files in those locations as a handful might have some relevance to other applications. I can see that it is probably safe to delete most after a certain date, but I wouldn't know which are the essential ones and which are produced by ESET. The problem is that the location forms part of the system state backup, this has increased our cloud backup times, and of course is pushing our quota up. If someone could tell me if there is a way of identifying which files can be deleted (e.g. by a sting in the file name) I could run a batch file to trim. BTW one side effect of me looking into those directories was that I inadvertently changed the security permissions, which had other consequence for other programs, including MS sqlexpress 2014 which is part of the ESET windows package.

I ended up uninstalling ERA and reinstalling ERA & Agent. Now OK.

OK I have run process monitor and I can see that ERAAgent.exe is creating many of the files

The agent appears to stall on my ERA server (win 2008r2) I attempted to reinstall via the previously downloaded agent install batch file , no change. From the windows event log: Log Name: System Source: Service Control Manager Date: 12/10/2016 21:52:51 Event ID: 7024 Task Category: None Level: Error Keywords: Classic User: N/A Computer: xxx.xxx Description: The ESET Remote Administrator Agent service terminated with service-specific error The remote server has been paused or is in the process of being started..

Thanks for the reply. I have installed process monitor for when the next spate starts. Earlier today I updated the agent on the network to the latest version, I also updated an older EFSW from 4.5 to 6.4. So far I have had no further files created. I will update with process monitor info if files start appearing again. BTW don't know if it is related by the agent on the machine with ERA is failing to report, I think I'll start a different thread for that as possibly a red herring here.

I have a small windows network where the ERA runs on the only server (2008r2) in the network which is also a domain controller. Since upgrading to ERA 6.4 I have seen an increase in files in the following 2 directories: C:\ProgramData\Microsoft\Crypto\SystemKeys C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 (we are talking thousands of files in each case) From a couple of google searches it appears that these may be related to https request to the server, and ESET software is mentioned as a possible cause. Is this something anyone else has seen? regards Roga

Hi Michal, thanks for asking. We are running some windows remote desktop servers to which thin clients connect. Effectively we want the same options on these servers as our win 7 clients. Initially this will include some changes to the GUI, e.g. suppressing windows update messages, setting eset warnings to critical and above, forcing presentation mode off, hiding the splash sceen etc. Also setting email notifications. I also want to set a once a week full system scan. As I get to know ver 6 a bit better I may want to adjust other settings such as email and http settings. Because we are using remote desktop servers, we pretty much need the same options as we would have on windows clients.

Not sure I like the answer, but at least it is clear: looks like I have to set 2 policies to do more or less the same thing!

I see that there are separate entries for "Eset Security Product" and "Eset File Security for Windows Server" on the policy tab. If I set some options in tools and gui for "Eset Security Product" and assign it to a group, will this also apply to EFS clients in that group?

Thanks for the help, task completed succesfully using operating system\uninstall followed by Eset Security Product\install

I think the short answer in my case is uninstall first, then install the newer version. What I hadn't realised is that the task for uninstalling an eset product is not under "Eset product security" branch, but under the "Operating system" branch in the admin GUI. It also looks like I have to uninstall each sub version individually, or is there a way I can uninstall the various sub versions from one task?

I have latest era 6 in a windows environment I have some servers with eset file security 4.5.* I would like to move them to latest version (6.*) I have had a search for how to remove older eset products, but can't find anything. All I can see are instructions on how to upgrade, which look the same to me as instructions for a new roll out. Is there a way to run an uninstall of the old product followed by an install of the new? Or should I just roll out the new product over the top of the old one? (I am a little nervous as in my experience upgrading or uninstalling older eset products doesn't always work as automatically as I would like - in more than one previous case I have had to manually reinstall an older product before uninstalling it later) regards Roga

sorry posted in error

Is it possible to install eset era v6 and associated services (sql etc) on a drive other than c? (windows 2012r2)

Can I use wildcards in approved senders list? e.g. *.domain.dom for all emails from domain.dom?