anyWARE-Mainz
-
Posts
33 -
Joined
-
Last visited
Content Type
Events
Profiles
Forums
Posts posted by anyWARE-Mainz
-
-
Thanks. I'll try that
-
Hello,
we use GPOs for different thing. Some GPO registry settings affect Malwarebytes, so it quarantines and logs them.
How do I exclude with wildcards?For example, if I like to exclude: \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\ACTIVEDESKTOP|NOCHANGINGWALLPAPER
I tried the above syntax and just: NOCHANGINGWALLPAPER
Neither worked. It's getting logged and quarantined.
Regards
Daniel -
Hello Dyllon,
"The communication to the clients from the server is not the type you'd expect. It is not a push config, the clients are what control their own communication back to the server based on the interval you define in the policy."
No, I did not expected this. This behaviour is clear, nearly all managed software acts this way. I Just hoped/wish, that remote-installing clients (or upgradeing them) will
maybe get more comfortable in the future - I compared this to "regular" antivirus software management consoles for mid-range or enterprise customers.Thank you, let's see, what the future brings...
-
Hello,
I'm not sure, if this is the right place...
Are there plans to improve the abilities to upgrade client-agents?Instead of going through admin -> client push install, it would be more comfortable to just upgrade the clients bei rightclicking
in the tree-view (on the group or on the client/s itself).Or do I miss a point and there is actually a clearer way to do this?
Regards
Daniel -
Same issue here.
Case opened since 27.03.2017. Still no progress on this issue.What I saw on the regarding clients (sccomm.log):
Debug 2017-04-26 16:43:50.0724 4304 7 Download signature file: https://***.***.***.***:18457/SignatureDownload/rules.ref
Error 2017-04-26 16:44:50.0048 4304 7 Failed to get signatures: System.Net.WebException: Der Remoteserver hat einen Fehler zurückgegeben: (503) Server nicht verfügbar.
bei System.Net.WebClient.DownloadFile(Uri address, String fileName)
bei SC.Client.SCComm.ClientCommService.Communicator_NewSignaturesAvailable(Object sender, NewSignaturesAvailableEventArgs e)
vs2015sv and smallen50: Do you have the same "503" errors in your log?
(C:\ProgramData\sccomm\sccomm.log)The error 503 is kinf of misleading, because the server is reachable in every way. You also can download the "rules.ref" manualy by doing it through the webbrowser
(pointing at the local server url).Regards
Daniel
Registry exclusion syntax / not working?
in Malwarebytes Nebula
Posted · Edited by anyWARE-Mainz
It does not seem to work:
I did it like that:
How may I remotely check, if the Client got the Exclusion?
What else may be the issue?