cancel
Showing results for 
Search instead for 
Did you mean: 
jay_mm
Level 7
Report Inappropriate Content
Message 1 of 3

Automatic Response for On Access/Access protection being disabled

Hi,

Does anyone know how to generate an automatic response for when the On Access or Access Protection features of VSE are disabled by the end user?

It doesn't appear that this is sent to the ePO as an event?!

We're running the latest version of ePO 4.6.

Many thanks

J

2 Replies

Re: Automatic Response for On Access/Access protection being disabled

Thats a great idea

I think the followng event ID's should give you the information around the On-Access Protection

1087

On-access Scan started

Informational

1088

On-access scan stopped

Informational

1090

OAS stopped

Warning

You'll need to ensure that these are being logged to the database & also amend the agent settings to make sure they get sent immediatly if required (Caution as you may get flooded with events.

On the AP side I'd love that info as well

mjmurra
Level 12
Report Inappropriate Content
Message 3 of 3

Re: Automatic Response for On Access/Access protection being disabled

I looked at this a few years ago, and the issue was these events would be pushed up any time a computer was rebooted (stopped when it was shut down / started when it booted up). Made it useless as a diagnostic tool.

Things may have changed of course, but extensive testing would be required.