brummel
-
Posts
16 -
Joined
-
Last visited
Posts posted by brummel
-
-
Is it possible to automatically repeat a failed client task?
Would be nice to have a feature like "Retry in once per day or after a reboot".
I really get annoyed by ESET because client tasks fail for whatever reason (which is not shown in RA!) and I have to repeat the task by hand.
-
Deploying a registry setting per GPO would be much easier than uninstalling, rebooting and installing.
Nearly all of the clients of mulitple customers have this problem as I had updated from v5 to v6.
Would be nice to have the information what setting/registry key needs to be modified to decide which way is easier.
-
After reinstalling v6 it looks like the false alerts about HIPS do no longer appear. No false alerts till now.
Is there any other way to fix this or do I have to uninstall and reinstall v6 on all clients which were updated from v5 to v6?
-
This was an upgrade from v5 to v6. I will try to uninstall v6 and reinstall it.
I'll be back :-)
-
Anyone else seeing this?
I have enabled sending of emails from endpoint antivirus 6 and every now and then but at least 4 times a day I receive emails with the following text:
"During execution of on the computer xxx, the following event occurred: Fehler bei der Kommunikation mit dem Treiber. HIPS ist inaktiv."
Installed is the latest version 6.2227 in german language and all ESET services are running happily. Nothing special in the windows event logs.
This will happen most likely after a reboot of the systems (Windows 7 64 bit German) but it ocurres during the day too.
Regards,
Brummel
-
And the installed modules:
Signaturdatenbank: 11339 (20150318)
Soforteinsatz-Modul: 5696 (20150318)
Updates: 1056 (20150113)
Viren- und Spyware-Schutz: 1451 (20150224)
Advanced Heuristik: 1154 (20150129)
Archivunterstützung: 1221 (20150304)
Säuberungstechnologie: 1105 (20150120)
Anti-Stealth-Unterstützung: 1070 (20150209)
ESET SysInspector: 1245 (20141028)
Self-Defense-Unterstützung: 1018 (20100812)
Echtzeit-Dateischutz: 1009 (20130301)
Lokalisierungsunterstützung: 1322 (20150226)
HIPS-Unterstützung: 1166 (20150310)
Internet-Schutz: 1180 (20150304)
Datenbank: 1064 (20150303)
Konfigurationsmodul (33): 1054B (20150216)
-
BuildLabEx: "7601.18741.amd64fre.win7sp1_gdr.150202-1526"
As written earlier: Installed is ESET Endpoint Antivirus 6.1.2222.1 (german)
The current endpoint version was installed as an updated on v5 eset endpoint antivirus.
The same constellation is used for other customers and is running without HIPS warnings.
-
Yes it is running.
SERVICE_NAME: ehdrv
TYPE : 1 KERNEL_DRIVER
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0 -
Just to make it clear, a computer restart is required for disabling HIPS to take effect. Have the target machines been restated and you're still getting email notifications about HIPS not working?
The clients have been restarted more than once.
According to the configuration requested from the clients and shown in the admin console HIPS is disabled. But I still get the mails about HIPS not working.
Funny thing is: This happens only for one customer out of three and there is nothing special in the installation of the client computers (all Windows 7 Pro 64 bit).
Is there any log file I can request from the client which tells me something about why HIPS is not working?
-
Regardless of the issue, why would you want to disable HIPS which is as crucial protection layer as real-time protection?
For me: Because I get warning emails that HIPS is not working. Most of my clients do send this email every some hours.
So I decided to disable HIPS until a new endpoint version is available or I have time to investigate this issue.
-
Maybe I have the same problem - but with ESET Endpoint Antivirus v6.
I have disabled HIPS in the settings but still receive warning emails about "Communication with the driver failed. HIPS does not work."
-
Thanks for your help.
Some remarks:
- I setup the filter for the application name as "has prefix": "ESET Endpoint" in order to get the different Endpoint products
- My regex for the application version is: ^[0-5]\..+
-
I want to create a dynamic group which contains all windows clients that do not have the latest ESET antivirus 6 running. This dynamic group should contain all clients which are running an old antivirus or no antivirus at all.
Next step would be to use this dynamic group as a trigger for an deployment task in order to get the latest antivirus software installated on the clients automatically.
The remote agent is already installed on the clients (using GPO and 'run once' registry key).
Can someone give mit a hint how I have to setup the dynamic group template expressions?
Is there some documentation about the expressions available?
Regards
Brummel
-
Thanks for your answer.
BTW: Is there any place where I can see what the ESET apache HTTP proxy server is doing in order to check if my clients are correctly using the configured chaching proxy server?
-
I'm confused about different proxy settings in the security product proxy settings.
There are two different places where a proxy can be configured:
- Update - HTTP Proxy
- Tools -> Proxy Server
So which one does what and where do I have to configure a caching proxy to minimize internet traffic on client updates.
Regards
brummel
Automatically repeat failed client task
in ESET PROTECT On-prem (Remote Management)
Posted
I'm using:
ESET Remote Administrator (Server), Version 6.3.136.0
ESET Remote Administrator (Web Console), Version 6.3.114.0