ERA 5.1.34.0 / Endpoint AV 5.0.2225.0 - Client tasks run but don't exist in console

[thetapeworm 0]

Firstly apologies for jumping straight in with a question but I find myself working on a new account that uses ESET and I have very little familiarity with it and a problem to solve - I hope you'll be gentle with me! I suspect this is a very basic query but I can't seem to find any answers or am asking the wrong questions / looking in the wrong places.

 

The initial issue raised by the client is that the scan on the client PCs is taking place at a less than ideal time - I had hoped this would be a quick fix and that a visit to the remote admin console on the server would allow me to make the change needed. Unfortunately this doesn't seem as easy as expected as there are no tasks appearing in there for me to modify.

 

If I look at one of the clients in the "Clients" tab and view the properties for it there are 0 tasks in the "Tasks" tab. If I Open the Configuration Editor and view the "Scheduler/Planner" entry it shows 8/0 - opening this up confirms there are 8 tasks present in here:

 

• Log maintenance
• Regular automatic update
• Automatic update after dial-up connection
• Automatic update after user logon
• Weekly Scan
• Weekly Scan
• Automatic startup file check
• Automatic startup file check

 

One of the Weekly Scan tasks is the one I'd like to change, the other needs to be removed completely, Unfortunately highlighting any of the entries in the Scheduled tasks window only allows me the option to view "Details" - all the other options (Add, Edit, Remove etc) are greyed-out.

 

Policy Manager / ESET Configuration Editor shows 0/0 under the "Scheduler/Planner" entry for the server policy with all the clients against it and has a 0 in the "Rules" column.

 

Scan Log details confirm that the Weekly Scan is running at the time scheduled in the client properties view.

 

 

Questions at this stage:

 

1. If the client is reporting it has a configuration is this likely to exist on the client only and run independently of the remote admin console or should the two always be linked?

 

2. Should my "Tasks" tab be empty in the console if there are active tasks present on the clients it's aware of?

 

3. From the above does it sound like I have an issue or is this all just a lack of product understanding on my part? I've attempted to look up what I can, read documentation etc but what I'm seeing vs what I read doesn't seem to match up.

 

4. Is there any way to pull the task information from the clients back up to the administration console so that it can be modified and sent back down to all? I see that I can export data from the clients in XML format but is there a similar file on the server somewhere that should be controlling things too?

 

5. Worst-case is there a way to tell all the clients to forget eveything they know about scheduled scans etc and then create new ones for them to pick up?

 

6. Can I provide any additional information to clarify the above or help troubleshoot what I'm seeing? Being new the product means I'm not completely sure what information I should provide beyond what I have already so please let me know if I've missed anything.

 

 

Thanks in advance for any help you can offer on this and I promise to do more homework in the meantime.

 

[Marcos 5,228]

1, Yes, it's possible. The only way how to prevent this is by protecting configuration with a password and to use a policy with desired custom tasks.

2, Unless you click Default, only custom tasks will appear in the list (e.g. if you download configuration from a client).

3, In order to delete custom tasks, you'll have to tick the "Revert to default tasks..." box. To delete a concrete task, download configuration from a client, select the task for deletion and then push it back on the client. If you know the task's ID, you can skip downloading configuration, ie. add it to the list manually, set the correct ID that matches the ID of the task on the client, mark it for deletion and finally push the configuration on the client.

4, You can download configuration from a client, edit it and then push it back on one or more clients.

5, Yes, as explained in point 3 ("Revert to default tasks..." box).

 

You can also try out the new ERA 6 and Endpoint v6 in a testing environment. The new version is currently available in the US and Canada with other countries to follow soon.

[thetapeworm 0]

Many thanks for taking the time to reply Marcos, I appreciate your detailed help. This certainly gives me some options to try to sort the mess someone has passed on to us

I seem to recall seeing the task ID so I'll read up about deleting from the server side when I'm on next.

Thanks again.