Jump to content

disable EIS and have windows defender running instead


Recommended Posts

Hi, would anyone know how to disable EIS in such a way that windows defender is running? This is an old frustrating issue. I upgraded to 13.x and now i cannot connect to a vpn using Pulse Secure (which only supports 12.x). I recall I read somewhere that you can alter a setting in windows somewhere such that when you reboot the pc, it will have EIS completely disabled and have Windows Defender running. I tried disabling realtime protection, but that doesn't work. I tried stopping the EIS service, but i get 'access denied'. The only way i can see around this is to set up a virtual machine with no EIS installed, and access the vpn through that. There should be a way of disabling it completely though. Thanks

Edited by kellyz
Link to comment
Share on other sites

If you disable real-time protection in the Eset GUI, WD real-time protection should kick in automatically.

Just make sure you verify that WD's self-protection is enabled.

Link to comment
Share on other sites

  • Administrators

You can uninstall v13, install v12 and temporarily disable program updates in the advanced update setup until Pulse adds recognition of v13. We'll try to contact them through our IT support.

Link to comment
Share on other sites

Thanks for the replies. I tried staying on 12.x with updates disabled, but it was annoying me with frequent popups  in relation to module updates unable to be installed.

But the good news is that I seem to have been able to solve connectivity with EIS 13.x using Pulse Secure.

What I had to do was:

  1. Advanced Setup > Detection Engine > Real-time file system protection > [Disable] Enable Real-time file system protection
  2. Advanced Setup > Network Protection > Firewall > Basic > [Disable] Enable Firewall
  3. Right click EIS taskbar icon and select "Pause Protection"

Now I can connect to my company vpn under 13.x.

I noticed if I perform the above steps out of sequence, i.e. step 3 before step 1 or 2, it does not work. I need to perform step 3 at the very end. I am not sure why. Maybe pausing protection, then disabling the firewall and real-time file system protection doesn't shut down certain modules correctly. I am also not sure why I have to do step 1 even if I do step 3, because doing step 3 tells me it is deactivating real-time protection anyways, which is confusing:

Untitled.jpg.72f3e0c8426c15dd565e3925d411d631.jpg

So doing steps 2 and 3 alone will not work... confusing... But anyways, I got it working now and I am happy.

Thanks again for all your help.

Edited by kellyz
Link to comment
Share on other sites

  • Administrators

Having ESET installed but disabled and Defender protecting your computer doesn't make much sense. You should be able to use v12 until without any pop-ups with program updates temporarily disabled. Did you actually disable program updates when you had v12 isntalled?

Link to comment
Share on other sites

Yes I had v12 installed and disabled program updates. But I received notifications telling me that there were issues installing various modules as a result for some reason.

The whole idea behind disabling v13 was to obtain access to the vpn using pulse secure. As you know pulse secure doesn't allow v13 to connect (only v12). Once connected, I just enable v13 back again... that's it. How else would I go about doing this in a simpler manner? I don't want to be stuck on v12 with updates disabled, that makes no sense; and I have no desire to run Defender.

I still have no idea why i have to execute all three steps to allow pulse secure access (steps 2 and 3 should be enough), and why executing step 3 before step 2 doesn't work. If anyone has any insight that would be great.

Edited by kellyz
Link to comment
Share on other sites

  • Most Valued Members
19 hours ago, itman said:

If you disable real-time protection in the Eset GUI, WD real-time protection should kick in automatically.

Just make sure you verify that WD's self-protection is enabled.

Does the Anti-Tamper really do it's job ? or it's just a name?

Link to comment
Share on other sites

  • Most Valued Members
5 minutes ago, itman said:

Seems to be effective. I haven't seen a published bypass of it to date.

I remember when it used to be a registry entry , one line would disable the whole protection.. :D

Link to comment
Share on other sites

21 minutes ago, Rami said:

I remember when it used to be a registry entry , one line would disable the whole protection.. :D

I also recently read a posting in another forum that indicates in Win 10 1909, not only is WD self-protection enabled now by default but also WD self-sandboxing. Previously, WD sandboxing had to manually enabled via PowerShell command.

Link to comment
Share on other sites

  • Most Valued Members
3 minutes ago, itman said:

I also recently read a posting in another forum that indicates in Win 10 1909, not only is WD self-protection enabled now by default but also WD self-sandboxing. Previously, WD sandboxing had to manually enabled via PowerShell command.

So it does sandbox the file and run it inside and see what is result? and then determine the file?

Link to comment
Share on other sites

12 hours ago, kellyz said:

What I had to do was:

  1. Advanced Setup > Detection Engine > Real-time file system protection > [Disable] Enable Real-time file system protection
  2. Advanced Setup > Network Protection > Firewall > Basic > [Disable] Enable Firewall
  3. Right click EIS taskbar icon and select "Pause Protection"

Actually, all you needed to do is step 1). to activate WD's real-time protection. If running with WD real-time protection and you still can't connect to your VPN, the issue is not Eset's real-time protection. The issue appears to be Eset's firewall instead.

I have not yet been able to figure out how to disable Eset's firewall and have the Windows's firewall auto activiate.

Edited by itman
Link to comment
Share on other sites

49 minutes ago, Rami said:

So it does sandbox the file and run it inside and see what is result? and then determine the file?

No. The WD kernel process itself is sandboxed. MS did this to prevent malware from spreading if the WD kernel process was compromised.

Link to comment
Share on other sites

  • Most Valued Members
22 minutes ago, itman said:

No. The WD kernel process itself is sandboxed. MS did this to prevent malware from spreading if the WD kernel process was compromised.

I understand , thank you for the information my friend.

Link to comment
Share on other sites

19 hours ago, itman said:

Actually, all you needed to do is step 1). to activate WD's real-time protection. If running with WD real-time protection and you still can't connect to your VPN, the issue is not Eset's real-time protection. The issue appears to be Eset's firewall instead.

I have not yet been able to figure out how to disable Eset's firewall and have the Windows's firewall auto activiate.

This is the warning i get from Pulse Secure with 13x:

917690704_Annotation2019-12-09183022.jpg.a81e42943454046f8cee40cf89b9ede8.jpg

I need to perform all three steps. I tried all combinations 1, (1,2), (1,3) etc. (1,2,3) works for whatever reason.

 

Link to comment
Share on other sites

  • Administrators

Our IT department will contact Pulse Secure regarding v13 support. In the mean time, you can uninstall v13, install v12 and temporarily disable program updates in the advanced update setup.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...