Search the Community

The short version: 1. It seems that managed Mac clients are only partially honoring exclusions. a. Eicar test files placed in excluded directories are being ignored, as expected. b. Files in excluded directories are still being scanned on access, which is not as expected. 2. Unmanaged Mac clients appear to be honoring exclusions correctly. The long version: My MacBook Pro is affectionately referred to by my colleagues as the "Wind Tunnel" because its fans are constantly going at high speed. And its fans are constantly going at high speed because my managed ESET client is constantly scanning files in directories that have supposedly been explicitly excluded from scanning. A good example is Backblaze's working directory. Since Backblaze is constantly updating its indexes, logs, etc, there's always a lot of churn going on, so I've explicitly excluded Backblaze's working directory… /Library/Backblaze.bzpkg/*.* …via policy (as specified in numerous Knowledgebase articles). And I can tell the exclusion is working (at least in part) because when I place a copy of the Eicar test file in the /Library/Backblaze.bzpkg/ folder (or one of its sub-folders), the ESET client ignores it. But the moment a Backblaze backup kicks off, my managed ESET client starts scanning every file that is accessed in Backblaze's supposedly-excluded working directory, pegging the CPU, and causing the fans on my MacBook Pro to start screaming. Here's a screenshot that shows both the exclusion in the client, as well as the client completely ignoring that exclusion: The same is true of Time Machine backups, as well. Even though I've gone to great lengths to exclude every possible permutation of Time Machine path and volume name, ESET starts churning through every accessed file in those supposedly excluded directories/volumes the moment a Time Machine backup starts. I've only seen this behavior with managed clients. If I install a standalone version of the exact same client with the exact same exclusions, the exclusions work as expected. Even with Backblaze and Time Machine backups happening simultaneously, files in those excluded directories never show up in the scanned objects stream and my fans hum along quietly. But the moment I connect the ESET client to a Remote Administrator server, the scanned objects stream becomes a raging torrent of files in directories that it should be ignoring, and my fans kick into overdrive. I've tried adding/removing policies, creating new policies from scratch, and applying those policies at different levels in the group hierarchy. I've tried uninstalling and reinstalling the client multiple times, as well as going from managed to unmanaged and back again. I've also tried different syntax permutations for the exclusions (including two wildcard symbols (*.*), one wildcard symbol (*), and no wildcard symbol at the end of the path), but the problem remains. Any ideas? I'm out of them…

Hi Guys, I have an issue at the moment with the way my policies are handles. We resell Eset using the MSP platform and have a central Eset Administration Console. We point all of our clients to this console so there is only one point of configuration. An issue has come up after I was looking at one of our clients Eset client and noticed that our AV exceptions are not getting merged together. I currently have it set up so we have a policy for each application that has exceptions. These are all set to Apply and not Force but when looking in the exception list on the Client I noticed that the last policy gets applied. Is there a way of making it possible for the policies to merge the exception paths when they are presented to the Eset client? We have about 7 of these policies for individual programs so if this isn't a feature I think this should be. Please help!

Hi, Facing issue while activating Endpoint Client AV using remote task. Client is using ERA 6.4 and AV 6.4 while giving activation task it goes fail. Client AV doesnt have internet access, we have setup apache http proxy. Then tried activating AV individually but unable to activate. Gives error unable to reach to activation server We ran V9ActivationTroubleshooter provided by support[at]eset.com again tried activation and its successful. Here I am attaching the logs checked on 2 different workstation within the same network. Since this is the only solution, can we save the file on network path & use run command from ERA to execute this file on client workstations with fix syntex 1 V9ActivationTroubleshooter.txt 2 V9ActivationTroubleshooter.txt

One of our customer has installed ERA 6 on windows 8 system. Firstly he has added NFR license on ERA and then activated few Clients AV, after some days later he received his new license, so he removed NFR license from ERA & added new license and then again triggered activation task from server selecting new license, even after successful task, client expiry date and license detail doesn't change in client AV. Also tried activating license on individual client but same issue. I tried activating remotely and separately on client system but same issue. Screenshot of the client details as follows: Screesnshot_1: Client PC, still showing old license after activating with new license remotely. Screesnshot_2: Client PC, still showing old license after activating with new license remotely and separate activation on Client. Screesnshot_3: Client PC, Showing new license activated individually (No remote task) Screesnshot_4: New License uploaded on ERA. Screesnshot_5: Activation Task created with new license. Screesnshot_6: Task finished Successfully but still Expiry date doesn\'t change (Clients are screenshot_1 & 2)

Dear Support, We need to allow some of the remote utilities which are detected and removed by the eset, please advise a process to make them while list to a group of machines. Thanks shaik

hi how to manage v.5.x installed product from era 6.3 like activation,update? Vimarsh.P

Greetings, I've already had issues with this laptop in regards to installing ESET Endpoint Antivirus with the remote administration client and in the end I had to install it manually. It was picked up by the remote administrator and is being managed by it but when I try to activate the product it fails. I tried to use the Security Admin option but it said that the servers were unavailable. Any help would be appreciated. Regards André

Hi, I have installed ERAS 6.2 around two months back and agents & client AV installed on approx 500 users, Yesterday due to some issue my Server got crashed and I am unable to recover the system, hence I have installed new ERA server on different system. As per my knowledge, to make the communication between Agent and new ERAS I have to follow one of the below steps, 1) I have to re-add the certificate and change the IP by repairing ERA Agent in each and every system manually 2) I can perform remote deployment of agent from ERA WebConsole, 3) Installation through live installer batch file As per the point 1, manual installation is not possible to do in all 500 workstations. In scenario 2, many of workstations are not connected to the internet for remote deployment, Point #3 again asking to run agent live installer in every workstation manually, which requires manpower to install in 500 clients and it is also a time consuming task. So kindly let me know if any other way available to make communication between agent and new ERAS other than above method.

I'm trying to install EES remotely from the console but task is getting failed and unable to get the reason why task is failed. Kindly let me know how to check the failed task report so that I can identify the problem to fix.

Good afternoon, I have a Remote Administrator installation and have successfully deployed the agent and client to most computers successfully. One issue I have encountered is that almost all computers show as yellow in the RA with the following error "The feature is not monitored by Windows Security Center" listed as the worst functionality problem when in the details window of a computer. See the attached file. I can't figure out how to either ignore this error or correct it. I think it has something to do with the firewall as per the 2nd screen shot. Any help with this would be much appreciated. Thank you CW

Hello, after not receiving any response to my support ticket which i sent like 2-3 weeks ago. I am now writing this here hoping that someone will help me. We have recently upgraded to the recently released version 6 and to be frank it is giving such headache, i never had this much trouble with a product. I have configured a Apache http proxy so that the client pull the updates from the proxy however i am not sure if it is working or not. In the web console i can still see that the clients have an error that they cannot update the database which is weird because i followed the guide. Guide being used: hxxp://kb.eset-la.com/esetkb/index?page=content&id=SOLN3637 Am i missing something here, do i need to make further changes in my administrative console or in the clients themselves. I would also like to mention that remote installation of agent and clients are also not working properly. Basically the only three configurations i am trying to make are all not working.

I have recently migrated from eset 5 to 6 , and the remote administrator has been very uneven in picking up the users (all users were detected in eset 5. of ~150, about 60 are being detected after the migration. Remote Administrator also seems to only intermittently tracking activity on the computers it does see, and will display errors and active threats that have been cleared on the end user's pc (upon remoting into the end user pc, it will show clear of threats, despite continuing to show warnings. I do not use a proxy for the client pcs For the pcs that it is not detecting, i am unable to figure out exactly why they have lost communication and are unable to regain contact. I have tried a variety of methods to connect them, without success. First attempts were to deploy a client task to the entry that was migrated to the new server, which only shows failures in task logs, manually installing eset 6 on a non-communicative pc does not appear to get that pc to regain contact with the new server, nor will it attempt to add a new entry. I am assuming that i am missing something, but have not seen any steps within the documentation to address the issue from either the client or server side. any help would be much appreciated.

hie guys any one with an idea or work around on how to get the ERA installed on multiple work station on a domain? my Admin console seems to show that the deploy task was finished successful but if i look on the workstation on my groups it does not seem so show that the installed work station are now managed regardless of finishing the task deploy successfully. any assistance and contribution is greatly appreciated

Hello. I want to ask some questions about Endpoint Antivirus which may sound silly. My university is providing a licence of it to all of their academic personnel. I was thinking about installing on my personal computer, and also to my parents'. I did some research about endpoint products and found out that it can be easily monitored remotely. For example, the last time of user's log on, installed softwares, even the names of detected threats, just by using eset remote administrator. I'm wondering is this tool actually allows to spy on your client's pcs? Maybe that's why our school is offering us to install on our computers and monitor what are we doing online. Can you tell me what are the capabilites of eset remote administrator in terms of monitoring users? How far they can go to violate our privacy? Like finding mac & ip adresses, visited web sites, detected threats, installed programs on our pc? I have a personal eset license which ends soon and if they can actually spy on me with this endpoint product, I would just avoid it. I know I'm being overly paranoid about a university monitoring their 1000+ employees but just a thought. Thanks in advance.

Hello, Having difficulty figuring out the best way to force a client update of the ERA policy when changing a firewall rule. Is there a way to do this similar to forcing a client update of the anti-virus definitions? If there is no way to force the client to update the firewall rule in the policy, what is the typical interval at which the client will download the change to the policy? Thanks!

A little background first. My organization currently has a small test environment for EES 6 for Mac and PC. All computers were upgraded from EES 5 (PC) and Nod 32 v4 (Mac). We just began experimenting with v6 policies. First We noticed one of the PCs shows a "Smart Scan" in the computer scan tab with a scan date of 12/31/1969 4:00 PM, which is strange because we did not enable the "First Scan" policy. The scan itself has not made any progress and has been running for two days. The scan still appears in the computer scan tab after several restarts. Second In the computer scan logs, each of the scheduled scans (in-depth scan with strict cleaning, every morning at 1:00 AM) were marked "Scan in Progress." The same thing happens when we perform an on demand smart scan. The Log Files screen also seems to flicker when viewing the computer scan logs. Any ideas/thoughts?

I am using ZMC to push the agent and the client worldwide. The agent works great without the need for Internet (Machine in some locations do not have Internet) Now I am trying to build a bundle to build a bundle that suppresses the Activation Prompt immediately after the install. I have been looking but can't find a policy or switch to disable it. Any ideas? Thanks, John

Hi Guys, I would like to ask, I`ve purchased the ESET Endpoint Security with ESET Remote Administrator Console. After I installed the Endpoint Security into more than 300 clients, I went back into the ERA Console to generate a full report for all the Clients in my system, but the problem is, it only shows the top 15 of my client pc names. I noticed there`s a "Sum of All" at the bottom of the generated report but it can`t expand. Is there any other way to generate the full report?? My picture is attached in the comment below. Thanks a lot guys...

Hi, currently am doing an ESET Security installation (Replacing Eset AV) am a facing a strang issue on remote deployment ( no issues on normal installation on any PC) : installation task keep showing in-progress even if installation is completed or requiring restart . on some PCs i can see the ESET installed but does not have the configuration loaded and the AV os not loaded, additionally if i restart it removes it self! i cant see in program files neither add/remove and on console it says installing !. if anyone have clue or hint where should i check i would be graetfull. BR

I have configured some policy groups on ERA and I have noticed that some of the clients in the group aren't receiving policy update changes. Any idea of what might be the issue?

Using GPO auto deployment, it's only deploying to some computers not all. The majority of the users use windows 7. Is there anything I can check, any reason why it might only be deploying to some computers and not all? We have auto deployed several other applications to all and they worked okay.

I have a server setup with all clients being managed (Server version 5.1.34, Endpoint AV Client versions 5.0.2214). I would like each users to receive desktop alerts when eset finds a violation. In the policy configuration editor there is an option in "Windows desktop v5 | Kernel | Settings | User interface alerts and notifications" that states 'On multi-user systems, display notifications on the screen of this user:' Right now it is set to Administrator. Is there any way to set this to a variable for the currently logged on user? Can i use the windows system variable %username% here?

Hi guys, for new year we renewed the license, where we get a new username and password. Is there any possibility to automatically upload new credentials to users (about 50) if we still didn't connect the app with ERAS. Maybe some kind of a script or something like that? Maybe with MDM (AirWatch)? The client which are installed on mobile devices is Android - Eset Endpoint Scurity 1.2.116.122 Any idea is welcome

I am running ERA which monitors about 45 machines, all running EP Antivirus. I have decided to install EP Security on each, as I want the centrally managed desktop firewall. Before I start rolling out EP Security, I have a couple of questions that I can't find definitive answers to: 1. Do I need to uninstall EP Antivirus before I install EP Security 2. If so, can this be done through ERA I've been using ERA for years but only very basic aspects of it so your help and patience would be much appreciated. Regards Paul

Buenas tardes a todos, estoy escribiendo en español ya que no tengo un buen control del Ingles para escribir, aunque voy a poner la traducción debajo que me haga el traductor de google para ver si me pueden ayudar. En todo caso que me direcciones a un Foro en español de Eset en caso que exista. Necesito encontrar información, documentación o alguien que ya tenga experiencia con la herramienta Rip & Replace de ESET. Necesito hacer una migración de un antivirus que no es ESET, que ya tengo funcionando y se que dicha herramienta es para eso y asi no tener que desisntalar e instalar todas las PC manualmente y poder hacerlo directamente desde el Active Directory, alguien me puede ayudar con esto ya que son mas de 500 PCs. Muchas Gracias., Good afternoon everyone, I'm writing in Spanish because I have no good control of English to write, but I'll put the translation below let me google translator to see if I can help. In any case I address a Spanish forum Eset if it exists. I need to find information, documentation or someone who already has experience with the tool ESET Rip & Replace. I need to migrate an ESET antivirus is not, I have already working and that this tool is for that and not having to desisntalar and manually install all PC and power it directly from the Active Directory, anyone can help me with this because they are more than 500 PCs Thank you.,