OS X EP v7 - Web and email protection is non-functional

[j-gray 35]

This seems to be a recurring issue with ESET and OS X and I'm not sure what the resolution is at this point.

We have Web and Email protection disabled in the v7 policies (same with v6). And we have the policy set to not show Web and Email statuses on the endpoints.

Yet, v7 endpoints display to users a Protection Status alert: 'Web and email protection is non-functional'.

This seems to be the case whether the 'ESET Web&Email' service is active or inactive in the network settings under System Preferences. If the service is fully removed, it will prompt to allow the addition of the service at reboot.

Of course, if we leave the service active and allow it to connect, it randomly breaks network connectivity for no apparent reason.

How can we keep this service inactive and keep the client from showing an error to our users?

[Marcos 5,070]

You should be able to remove Web and email protection by running:
sudo /Applications/ESET\ Endpoint\ Antivirus.app/Contents/Helpers/ESET\ Web\ and\ Email\ Protection.app/Contents/MacOS/ESET\ Web\ and\ Email\ Protection --uninstall

After a reboot close the window asking about extension installation.

[j-gray 35]

1 hour ago, Marcos said:

You should be able to remove Web and email protection by running:
sudo /Applications/ESET\ Endpoint\ Antivirus.app/Contents/Helpers/ESET\ Web\ and\ Email\ Protection.app/Contents/MacOS/ESET\ Web\ and\ Email\ Protection --uninstall

After a reboot close the window asking about extension installation.

Unfortunately, not a viable solution for 800+ OS X clients.

We don't have this issue with Windows clients that have Web & Email protection disabled. I'm curious why the issue is specific only to OS X?

If the policy is set to not display the those statuses on the endpoint, why does it still display those statuses on the endpoint? Would this be considered a bug?

[Marcos 5,070]

I've inquired a colleague versed in Mac products and he suggested raising a support ticket.

1, We would need to know how you upgraded from Endpoint v6 to v7. The thing is if the machine is not rebooted after uninstalling v6, old extensions remain loaded which subsequently causes network issues. Also another AV being installed concurrently could cause such issues, however, I would rule out this possibility since you are an experienced user.

2, We have tested applying a policy that disables reporting of the non-functional web and email protection status and it worked as expected. Therefore the support would like to check exported policy that you used to turn off the app status. We recommend using a new version of the Log collector 1.0.83 which has not been published yet and will be provided to you by the technical support.\

Do the app status settings in the policy look like as follows?

[j-gray 35]

@Marcos -Thanks for the reply.

1) We run a typical v7 install task via the EP Console. For the most part, right now we're only running v7 installs on systems that are new and have no AV installed. In some test cases that already have v6 installed, we run the v7 install task without the reboot option. Rebooting does not seem to resolve the critical status issue.

If we manually remove the Web&Email network service, then reboot, ESET prompts again to install the network service. In that case, the warnings clear. Again, this isn't really a viable process with 800+ clients.

2) Yes, statuses look exactly as displayed in your screen-cap.

I gather that the recommend upgrade process may be 1) uninstall v6, 2) reboot, 3) install v7?

Edited January 26, 2023 by j-gray
spelling correction