Cannot change state of solidcore

[mlajoie]

i have a Windows 2016 server that is in enable mode but is not changing modes with commands from ePO.  I've sent the machine multiple commands to enter Observe and Disable mode.  They all return as completed but the agent never changes status.  It is a virtual server being managed remotely so we cannot put it into safe mode to disable it manually.  Please advise any steps we need to take.  Thank you.

[mkonno · Accepted solution]

Hello @mlajoie 

Thank you for posting on the community.

If the status of the agent's Local CLI access is "Allowed", those commands from ePO will not succeed. For these commands to succeed, the agent's Local CLI access must be "Restricted".

You can check the current status in the "System Tree" under "General" for Solidcore Products. If it is set to "Allowed", you need to change its status to "Restricted" via the "SC: Change Local CLI Status" task.

I hope this helps.

[mlajoie]

While we have the policy set to lockdown the CLI, this particular device had the CLI recovered by another admin. This wasn't the exact solution but it pointed me to the issue. Once I locked down the CLI, commands worked as expected.

Thanks so much.

[ktankink]

Hi @mlajoie Just FYI, MACC policy does not force the CLI lockdown; this is done via a SC: Change Local CLI Access client task.  You might consider scheduling a client task to run on a scheduled basis (e.g., once a week; once a day or every few days....your preference) on your MACC clients to ensure that the CLI gets relocked, just in case someone happens to unlock the CLI and forgets to lock it back down.

[mlajoie]

Good call. Thanks for that.