Auto Update - Disabled but downloading new endpoint version

[slarkins 5]

I have the Auto update disabled via policy. I have noticed that all my endpoints are currently updating from 9.1.2063 to 10.2045.0 . I was under the assumption that security type updates within same version (ix 9.x) would download and no way to stop but i thought i can control major updates from v 9.x to 10.x. I checked the policy on my endpoint and looks like it is disabled. Am i missing a policy setting to disable major version PCU type updates?

 

[Marcos 4,935]

Please provide logs collected with ESET Log Collector from such machine for a start. Auto-update to v10 shouldn't take place if not allowed by an auto-update policy.

[slarkins 5]

This is not machine specific....other than the 15 or so that have already rebooted to install new version..i currently have 42 endpoints waiting for a restart according to console...is there a policy setting i can check? The folders all the endpoints are in (multiple) those policies have auto update turned off...but i noticed at the top of the folder struction there is a read only policy enabled for auto updates. I would think policies below that and on sub folders would take priority?

 

Edited March 13 by slarkins

[Marcos 4,935]

Please provide ELC logs from such machine for a check.

[slarkins 5]

Log file is almost 90mb zipped. Where do you want me to place it?

[Marcos 4,935]

If it's not possible to upload it here, you can use a file sharing service and drop me a personal message with a download link.

[slarkins 5]

is it ok to drop log file in a public forum? not sure what info it contains

[Marcos 4,935]

Attachments in this forum can be accessed only by moderators and other ESET staff.

[slarkins 5]

log file has been uploaded

 

eea_logs.zip

[Marcos 4,935]

Please review the policies. Auto-updates were enabled by a policy on March 10.

[slarkins 5]

I have not modified policies for at least a year...if there was a policy "modified" on 3/10 it was me going in to the policies on 3/10 to determine why endpoints were updating to 10.x. Maybe i might have toggled Auto updates on and off but never saved any chnages.  No changes were made. the Windows 10 endpoints are in 2 folders (locations) and each has their own endpoint policy which have the same settings. Auto updates were turned off way back when that option was available in the policy options....below are screen shots of the 2 location containers that only have windows 10 endpoints ..each is a unique policy..neither have auto update enabled...does the log file say which policy name the was modified on 3/10 and which one the auto update was coming from?

Do i need to do the steps in the link below and assign the policy to the containers my endpoints are in that i dont want auto updating major version?

https://support.eset.com/en/kb8147-opt-out-from-auto-updates-in-eset-protect-and-eset-protect-cloud?ref=esf

[Marcos 4,935]

The auto-update setting is not applied on clients.

It should look like this if you would like to enforce it:

You can also change the assignment for the default (built in) Auto-update policy and remove the All group:

[slarkins 5]

removing the all group from the default auto update policy....or enabling (lightning bolt red) on my custom end point policies...that will just turn off major version updates...i assume security updates within same major product version will still happen?

[Marcos 4,935]

Correct. If you disable auto updates, security and stability updates for the given major version will still be downloaded and installed automatically.

https://help.eset.com/ees/10/en-US/auto_updates_faq.html

Are auto-updates configured only by policy? Can I disable the policy if I do not want an ESET product to be updated?

If there is a Security and Stability hotfix for an ESET Endpoint product, the product will be updated even when auto-updates are disabled, as per the terms set in the applicable EULA. ESET uses Security and Stability Hotfixes to address critical issues and ensure maximum security and stability for your ESET product.

You can assign an auto-update policy to any group of endpoints, regardless of their current auto-update configuration. In non-managed environments, the user can locally configure auto-updates in the Advanced setup screen of an ESET Endpoint product.

[slarkins 5]

thanks...i am going to wait until the rest of my Win 10 endpoints update to v10.x...then make policy change

one other question...all my Windows servers are either v7 or v8 end point file security. Is major version auto update for servers affected on v7 or v8 or do the servers need to be on v9 or later for auto updates to happen?