License status shows close to overused

[j-gray 35]

ESMC shows license count at 1584/1600. The console shows a total of 1334 clients and 184 of those show 'no status', so we only have 1150 installed clients. So we should have 434 licenses free.

The License Management section shows successful recent synchronizations.

I thought there used to be a setting to release licenses when clients are removed (after 90 days of inactivity) from the console.

How can I release these licenses that aren't in use?

[Marcos 5,090]

In the EBA portal you can sort activated devices by the last seen date, select those that haven't been seen for a long time and select deactivate.

You can set up automatic deactivation of such devices in the EBA setup:

[j-gray 35]

@Marcos Thanks for the reply. Yes, I contacted support and learned that I had to use Cloud Protect to manage these. I then had to migrate from ESET License Administrator to Protect Cloud. Just got that completed.

However, new question: the settings are configured to deactivate after 365 days. However, I have a number that are >1,000 days.

I'm not sure why these aren't getting removed. Is there a way to force this cleanup, or do I have to do it manually?

[Marcos 5,090]

First of all let's clarify the product names - ESET PROTECT Cloud is the former product ESET Cloud Administrator for managing ESET security products in cloud. Its on-premise counterpart is ESET PROTECT, formerly known as ESET Security Management Center.

EBA stands for ESET Business Account. It's ESET license management platform for business users, formerly known as ESET License Administrator (ELA).

As for why machines were not automatically deactivated, I've learned there's a bug in the current version of EBA which causes the option to not work. It will be fixed in the next version of EBA this month. In the mean time, please filter and deactivate such machines manually.

[j-gray 35]

Thanks for the clarification. I found it to be quite confusing. In part, because now I have to manage on-prem (ESET Protect) licenses in the cloud. And my password for ELA did not work, so I had to go to EBA to reset the password to be able to log into ELA.

It feels like a step backwards to have to use a second/additional product (cloud) to manage licenses the for primary product (on-prem). And even a further step backwards when the second product is not working reliably.

In the meantime, I've manually deactivated those machines that haven't been online in over 1,000 days.

Thank you.

[Marcos 5,090]

There were good reasons to have separate license platforms for consumers, MSPs and business/enterprise administrators. I assume that @MichalJor somebody else could name the most important advantages and benefits of such approach. It is of note that not all product licenses can be added directly to ESET PROTECT; for instance, ESET Dynamic Threat Defense must be added to EBA and then EBA must be added to the ESET PROTECT license manager. This is because EDTD is bound to an organization instead of a specific Endpoint license. As far as I know, there are plans to remove the option for adding license keys directly to ESET PROTECT.

[MichalJ 434]

Hello @j-gray. Changes in ESET Licensing, to use "EDF" (cloud based licensing backend, that is used by either ELA, EBA, or by ESMC/ESET Protect to show the amount of licenses) were triggered by continuously changing business landscape. New licensing methods, like monthly subscription, or large adoption of our software via MSPs, requested a more dynamic licensing solution. Also,  ESET has various deployment alternatives, where we do allow also installation of completely unmanaged (locally controlled) endpoints, or their control over RMM software etc.. So the licensing was designed to accommodate all of the use cases, which was in favor of a fully independent, and cloud based layer. 

I do agree however, that the excessive usage reported by EBA / ELA is a problem, that we are working to address. We have already a new HWF (hardware fingerprint) logic that should prevent further duplication of seats.

If your computers are regularly online, you can easily setup a shorter deletion interval, that should hold those two figures (actually managed computers, and computers reported as licensed) closely together. 

As far as I remember, you are within education sector, so 3-month interval would work. Alternatively, you can set it even shorter, and in case a machine gets accidentally deactivated, if it still in daily operation, you can configure a dynamic group, that will automatically activate our software upon entering (or can even try activations on applicable computers every hour, to just double ensure no issues will occur). 

[j-gray 35]

@MichalJ Thanks for the explanation, makes sense. It's just annoying to have to use a second product with a second account to manage the primary product.

I didn't look closely enough to determine if hardware fingerprints were an issue for us. It was primarily that systems had been out of contact for 1,000 to 2,000+ days, but had not been automatically removed from the console. So long as that piece gets fixed, we should be good.

[MichalJ 434]

You are right. Unfortunately there is no SSO between ESET PROTECT and EBA Account as of now (this is no longer an issue in Cloud, as EBA / EP Cloud share the same identity). 

With regards to the setting - my suspicion would be, that this setting was not there from the beginning, and when it was added, it did not act retroactively. Hopefully this would not happen again, but I will notify the team, so they can check if there are no issues with this functionality.