[Possible to block OneDrive in ESET Endpoint Security?]

On 12/31/2021 at 10:39 AM, Ufoto said:

Could you share your rule? 

You should create a block HIPS rule which affects applications and under 'Source Applications' you should set 'All Applications'. Then for application actions you should enable 'Start new application' and on the next screen you should specify the application you would like to block. The field supports multiple entries so you can have all possible locations. As far as I am aware you are missing one folder from your path. The OneDrive folders should be: 

C:\Users\<USERNAME>\AppData\Local\Microsoft\OneDrive\OneDrive.exe or C:\Users\<USERNAME>\AppData\Local\OneDrive\bin\OneDrive.exe

I hope this helps, let us know if you manage to sort it out.

Can I use a wildcard for the <USERNAME>?

I want it to be blocked for all user's on a given machine? Thanks

[Possible to block OneDrive in ESET Endpoint Security?]

Rekun, I appreciate your feedback!

 

I created a HIPS rule that blocks C:\Users\*\AppData\Local\Microsoft\OneDrive.exe, but I was still able to open the program.

I don't want to block the IP's for the reasons you indicated. I believe most of these IP's will be used by other MS service's.

[Possible to block OneDrive in ESET Endpoint Security?]

Is it possible to use the application blocking to do this?

If someone was to install onedrive at a later time, I would like to make sure it is blocked and they can not log in.

[Possible to block OneDrive in ESET Endpoint Security?]

Has anyone had success blocking OneDrive with ESET EES?

 

Thanks

[Log all web control events]

Got it! Thank you!

 

So the fact that this will eventually slow down the server and we have no way to clear the logs at a specific time frame on the server seems like a problem.

 

Can I put in a feature request asking that ESET get this feature added to the software?

 

Thank you

[Log all web control events]

Marcos,

 

Looks like I was able to get ESET to log all by going into web access protection > URL Address management > List of allowed Addresses and adding a new rule with * for the website.

Visiting cnn.com generates over 200 "Filtered Websites" logs (They do not appear under web control logs).

 

Do you know if it is possible to clear just the filtered website logs daily?

 

Thanks

[Log all web control events]

I changed the logging to warning and I am still not getting any logs on my endpoint telling me the sites I was visiting.

I only see blocks still.

 

It sounds like what I am trying to do... log all web traffic - is not supported can can cause issues with our ESET Cloud server.

 

Can I put in a feature request?

Searching this topic, I see several other's with very similar requests.

 

Thanks

[Log all web control events]

I followed the steps in the link above, but I am not getting any logging.

What I am trying to do is log every site visited on a endpoint rather is is allowed or blocked. I want 100% of the browser traffic logged.

I do get logging for blocked sites, but not for allowed.

 

Snip of the rule I made and applied to the top of the rules list.

[Log all web control events]

Hello,

 

Is anyone aware of a way I can set my ESET Cloud endpoints to log all web control events.

I am looking for a way to log all web events on my remote machines.

 

Thank you

[Future changes to ESET PROTECT (cloud)]

Description: Log all web control events with ESET Cloud

Detail: I am looking for a way to log all web control events / Websites visited with ESET Cloud / ESET Endpoint Security.

I would like to be able to specify a time frame on when these logs would refresh.

I found a KB that shows how to do this with ESMC, but I can not seem to get this working on ESET Cloud.

In addition, it would be great if we could get these logs sent to the server for auditing.

 

Thank you

[Prevent authentication to foreign networks]

6 minutes ago, itman said:

Don't know quite what you mean here.

By default, Eset Network Protection will only connect to the Network's gateway device if using the Public profile. Or and additionally,  other devices within the local network if using the Private profile.

The gateway reference here is usually a router. Once communication reaches the router, it is 100% under its control from that point on.

I would like to be able to prevent my computer from being able to authenticate to any other network then the one I am currently connected to.

Example. I am on a 10.40.5.x subnet (Network IP scheme).

If I were to bring my computer home, and tried to connect to my home network (192.168.x.x), I would like this to be blocked.

Looking to only allow this machine to connect to the 10.40.5.x network.

 

currently, I can join any wireless network and ESET has no issues.

 

Hope that clears it up a bit.

 

Thanks

[Prevent authentication to foreign networks]

Hello,

 

Has anyone had any success blocking foreign networks via ESET?

I am trying to have ESET block the computer from joining/authenticating to a 3rd party foreign wireless and wired network.

 

Any assistance would be appreciated. Thanks

[ESET SysRescue live is not working]

I was able to get this working with Universal USB Installer, 

It would be best if ESET removed Rufus from the documentation since it does not work.

 

[ESET SysRescue live is not working]

Bump

 

Any other help on this?

[ESET SysRescue live is not working]

I created the sysrescue USB drive via DD.

I tried to use the program on a win8.1 machine with a standard drive and it is working fine!

Now when I try to boot from my fujitsu p728 windows 10 (SSD), I keep getting brought back to the boot menu.

I can briefly see the message for a split second..

"isolinux.bin missing or corrupt".

 

PLease advise

[ESET SysRescue live is not working]

Hello,

 

I am trying to use Sysrescue on my Fujitsu P728 lifebook with a SSD.

The machine only has USB 3.0 ports.

I created the sysrescue bootable drive via rufus - (tried fat32 and NTFS).

When I boot to the thumb drive, I see the ESET logo, and then I get the following error.

 

 

[   1.0509996 mmc0: Unknown controller version (3). You may experience problems

BusyBox v1.22.1 (Ubuntu 1:1.22.0-15ubuntu1) built-in shell (ash)

Enter 'help' for a list of built in commands

(unitramfs) Unable to find a medium containing a live file system.

 

 

Please advise.