Jump to content

How to troubleshoot Device Control and Firewall issues


Recommended Posts

Hello All,

I just wanted to ask - is there an efficient way to troubleshoot Device Control and Firewall-related issue from the central console (in this case ESET Protect Cloud)? Although traffic is being blocked by the firewall we can't see any events in the console, and devices being blocked by Device Control are visible only locally. We created reports for Device Control and Firewall incidents, and although some firewall events are visible, they are only a fraction of the connections that are not working when Firewall is enabled. The firewall is set to Automatic Mode, and 'Also evaluate rules from Windows Firewall' is enabled.

If this is not available in the console, is there a Firewall Activity log file locally on the endpoints?

Thank you in advance!

Link to comment
Share on other sites

I think I've made some progress, I assigned the enhanced logging policy to some test devices, and I enabled Diagnostic Logs on some of the test machines and the blocked events started to appear. Is this the best way of doing it?

Link to comment
Share on other sites

  • 2 weeks later...
On 3/25/2022 at 4:13 PM, Ufoto said:

I think I've made some progress, I assigned the enhanced logging policy to some test devices, and I enabled Diagnostic Logs on some of the test machines and the blocked events started to appear. Is this the best way of doing it?

From what I have read and tested, the only possibility to get device control events on the server is to activate diagnostic logs.
But this gets disabled after the device reboots and the device gets marked with a warning because diagnostic logs are enabled.

A really useful feature would be that users can send an automatic e-mail, when the blocked device screen pops up. I've already requested that feature in the Future Changes.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...