Several issues with clients tasks and questions\suggestions about it

[mrac 5]

Hello.

I have several issues\suggestions\questions about client tasks in ESET Protect (we are using latest version of it and latest agents ang EES).

1. Question: is it possible to start tasks in ESET in chain, or with delay?

Problem: some computers (VMs, laptops) can absent in network for long time (months, sometimes year). When computer appears, it has outdated agent and security product. It appears in custom dynamic groups "Old agent" and "Old antivirus", which are triggering install of latest agent\antivirus. And one of them failing with error "Another installation running". Is it possible to create task "On dynamic group join" with delay for 5 minutes (for example) or start next task in chain? I didn't found it.

2. Suggestion about install tasks.

Sometimes installation failed when something installed by user in same time. Sometimes (not very often) msiexec.exe hanging and not installing anything till reboot. I created cmd task with command " taskkill /im msi* /f" and starting it if installation failed for 2-3 times, usually it helps. Is it possible to add some "Force install" flag to do it automatically? It is not very good, but it is needed when there are a lot computers with failed installation and users restarts rarely.

3. Another suggestion about install\update tasks.

I found that often (really, not kidding) update to new version of security product is failing because of service "ekrn"  are in "Removal pending" status. It is happened if user has started Task Manager or Sysinternal Process Explorer, they are blocking removal of services. I had this issue more than 100 times and almost always helps cmd task:

taskkill /im ekrn* /f
taskkill /im procexp* /f
taskkill /im taskmgr* /f
sc delete ekrn

 

Very tired of this. Can it be added to installer of agent and security product too? It is not so brutal as #2 and should have any negative side-effects.

Thank you

Edited April 2, 2023 by mrac

[Marcos 5,450]

Users should not be able to install newer versions on their own without administrator's consent. As for upgrading ESET to newer versions, the auto-update policy is enabled by default so Endpoint should upgrade fully automatically via the so-called uPCU. These updates install seamlessly after a computer restart.

[mrac 5]

Users not installing ESET. Users can install any MSI-based software (for example QA users can install new releases of our software several times during day). And if this time will be tried to install\upgrade ESET, installation will fail, because MSI doesn't support 2 installations at the same time.

uPCU installing with big delay as I remember. Usually we installing last version in several days after release.