Hi Alexander -
1. I was not aware of this ERA/ESMC entitlement. The migration guide doesn't mention anything about it: https://support.eset.com/kb7026/ It also doesn't mention how to configure the address of your ERA/ESMC server. I don't object to setting up a server to manage ESET, but its not what I expected, as SCEP didn't require it, and it means justifying adding another server into our data centre. If I can get away with configuring from the command-line, it would actually be easier for me, as I can do it all myself without a server administrator.
2. We use Cisco AnyConnect. Upon attempting to connect to our VPN, the following message appears:
Turning off the web and mail filter, which we've never had before, restores the ability to connect to the VPN. At a minimum, I need to be able to set our domain as an exclusion.
3. If I know which tool is the right one, I can usually figure things out on my own. esets_set doesn't seem to be it, unless I'm missing a step that makes it actually pay attention to the esets_set-supplied configuration. Right now, though, I just don't know where to start and it's not making much sense at present.
4. Yes, downloaded from here: https://support.eset.com/kb3614/ If that's the latest, that's fine; I realise now the "ESET Endpoint Security and ESET Endpoint Antivirus versions 7.0.2091, 6.6.2089 and 6.5.2132.2 have been released" may have been about Windows, not Mac.
5. As I mentioned, historically with Microsoft SCEP, scep_daemon had to be restarted to pick up the changes to the .cfg file. Trying to figure out how the ESET product works and get it to pay attention to the esets.cfg file, I was restarting esets_daemon and observing this behaviour. If the command line management tools interact with it more directly and it picks up change on the fly without a restart of the daemon, this may not be a big deal.