ESET Endpoint Security doesn't save settings

[danvaida 0]

Hello,

 

I went in and set up the client to connect to the machine running the ERA.

This was a fresh installation, all firewalls disabled, telnet working just fine.

 

I followed the instructions here: hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN2716 and all is good.

 

The only problem is that, after I restart the computer (Win 7 x64 SP1), the remote administration settings and all other settings that I configure in the client, get lost.

 

What could be the reason for this ?

 

Any help would be appreciated.

 

Thanks.

[Marcos 5,295]

Please check the registry value HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000600\Profiles\@My profile\RAClientServer and make sure it contains the correct ERA server name.

Also make sure the policy applied to the client by ERA contains the correct ERAS setting as well.

[danvaida 0]

Hi Marcos,

 

I don't see how all that would affect the fact that I cannot even save any settings whatsoever on the client; totally independent of the ERA link.

The server was not changed. I am using an IP there.

[Peter Randziak 1,171]

Hello,

 

do you use account with full administrator rights?

[Arakasi 549]

Just so we are clear on which settings ....

are you referring to these :
 

 

[Arakasi 549]

Please verify these settings here :
 

you may wish to unselect and try saving again with reboot.

 

[danvaida 0]

First of all, many thanks to everyone that jumped in to help.

 

@Peter Yes, I am using an administrator account.

@Arakasi That is indeed the section that I need the most, but none of the settings are saved (the Remote administration section is not an exception from this problem).

I will try to untick that checkbox for "Require full administrator..." but since that's also an option, I trust it might not be saved... making this a vicious circle.

 

Will let you know how this works.

[Marcos 5,295]

Maybe a Procmon log from the point of saving the settings would shed more light. After you create one, compress the log, upload it to a safe location and pm me the download link.

[danvaida 0]

Will do. Thank you.

[danvaida 0]

Thank you for your help Marcos.

 

Apparently this is now a company-wide problem. The clients just lost the ability of saving the settings so they are not connecting to the ERAC anymore. Whenever I restart the workstation (hybrid platform comprised of Win7/8 both x86/x64) the clients' settings are lost (administration password and remote administration settings).

 

To my best knowledge, I've reset the profile in the ERAC as I'm thinking that the problem resides in the ERAC.

 

telnet works just fine, there are no connectivity issues whatsoever.

[Marcos 5,295]

The Process monitor log showed that the ERA setting was saved properly on the client. A reason why a setting would be reset after a computer restart could be installation of a program like Deep Freeze or Steady State whose aim is to revert the system to a previously stored state upon a restart.

[danvaida 0]

Thank you for your input Marcos but that's not the case. No such third-party software installed.

[Arakasi 549]

Group Policy mistake ?

Workstations are not restarting properly ?

Workstations are a member of the domain ?

 

This is happening independant of the ERAC you say?

 

Have you tried this:

 

Remove the workstation from the domain, add it to an independent workgroup, run gpupdate, reboot. Uninstall Eset EA and reinstall. Then try changing settings and restarting the workstation.

This would eliminate the server or domain as causing the issue.

Although not on the domain, you can still enter the ERA IP in settings and have it report. Having the same subnet i think allows this.

 

Maybe then we can point fingers more confidently.

Edited January 24, 2014 by Arakasi

[danvaida 0]

Hello,

Thank you for replying !

No, computers are not a member of any domain.

All of them are members of the same subnet. As mentioned above, telnet works fine from each and every workstation.

I really don't know what else to do... Should I re-install ERAC ?

[Arakasi 549]

I have two additional things for you to look at.

Here is the first :
 

Make sure you don't have a password protected setup on the client viewed in the following picture.

 

 

 

[Arakasi 549]

Here is the second on the ERAC

 

Check for clients having a password here.

Tools > Server options

 

 

[danvaida 0]

Hello again,

Thank you for getting back on this.

The password... It doesn't stick around after I restart... just like any other setting done on the client.

I will check the ERAC, but I'm 99% sure it's like in your screenshot.

[Arakasi 549]

Hello again,

Thank you for getting back on this.

The password... It doesn't stick around after I restart... just like any other setting done on the client.

I will check the ERAC, but I'm 99% sure it's like in your screenshot.

 

I would click on the change button, and make sure its set or empty anyway, just for good measure.

[Marcos 5,295]

Try the following:

1, Change the setting, click OK and immediately open the setup and check if the setting is preserved. According to the Procmon log supplied, the setting was actually saved to the registry and wasn't overwritten, reset or removed while Process monitor was capturing operations.

2, If the setting was preserved in the previous step, check it out before a computer restart and immediately after the computer starts.

 

If necessary, I could connect to the computer remotely and check it out myself.

[danvaida 0]

Hello again,

 

For the sake of tidiness, I just want to let you know that I've managed to solve this by uninstalling ERAC and ERA server (living on the same machine), rebooting the machine, and adding the clients again, one by one.

Now the clients are maintaining the connection with the server and all their settings. This leads me to believe that something was wrong with the server.

 

Thank you very much all for your help.

 

Thread can be closed.