MarkFleming

Great, thanks Zynthesist.

Wow... just... wow. So this is why the mail helpdesk takes 24 hours to respond to anything? They're too busy answering the phone for 'premium' customers? BTW we are an MSP and still get really poor support (whether via phone or email), so maybe instead of threatening your customers you should hire some more engineers?

Hi Dashke, Thanks for reviewing the blocking of this site... are you able to please advise why it was blocked? Other security vendors will list a site history of it's classification, and why it was blocked when it does get blocked. I understand there is no similar 'self lookup' feature for malwarebytes, but would still like to know what caused this site to be blocked. This helps in understanding the risks in putting in exceptions, or at least gives us something to tell the users rather than "Oh it's just Malwarebytes again..." Sorry needing to start a new thread as you locked the previous. Thanks

Hi All, Can I please get a reason sharedspace.co.nz (resolving to 210.48.71.22) was blocked? Can I also get the block reviewed please? Thanks

Yes the support process needs a complete overhaul. We have to wait 24 hours between responses every time we log something, and the responses are generally making suggestions we've already tried (and outlined in the ticket we logged!), or links to knowledge base articles for products we don't have installed...

We're using C:\Users\*\NTUser.pol as an exclusion, and it seems to work? (Exclude a file by path). There's also examples of wildcards used in a directory structure for directory exclusions, but I can't say I've tried those yet...

Can confirm we are getting this too on multiple endpoints. Self Protection and rootkit scanning is disabled...

Thanks for the explanation. Any idea why RDS is cleared but Citrix is not, given that they are both multi-user OS's and will both run a process per user? Is it just a case of it still being run through testing to make sure it is OK, or are there active known issues with running EP on XenApp? I would love to have some clarity from the Product managers or the SE team...

Thanks djacobson... that's the exact opposite to what the sales guys told me yesterday when I raised issues with them. Thanks very much for your continued responses, but trying to deploy this product really is getting to be a shitshow. Conflicting and out of date information, no one 'true source' of what is correct and what is not... Do you have any insight into why RDS should be different from Citrix (I'm specifically referring to XenApp)? I'm assuming it's an issue with multiple user sessions, but if that's the case then RDS and XenApp would be functionally the same? I'm also pretty pissed off that the (quite frankly, glaring) limitations weren't communicated when we trialed the product. Can you confirm whether up to date information is being passed to sales teams, or is there any escalation process to talk to someone who has the full facts as to what the product does and does not support? I am of course raising ALL of these issues with the sales guys I'm talking to, but they don't seem to have the answers either.

@djacobson, can you please confirm which modules are supported for RDS/Citrix servers? Are there any plans to get those features working on server OS? It leaves a pretty big protection gap for my clients who run exclusively on RDS/Citrix...

Thanks Dyllon

Thanks for the response Dyllon. Any idea if this is a feature on the road map, or if I can submit a request for it to be added?

I'm getting the same... I'm guess that's probably a DHCP broadcast prior to being issued an address. Looks like a false positive?

... guess not...?

Hi All, Wondering if there is a way to have one policy which will schedule scans during a particular window, but randomize the times? So rather than having ALL of our endpoints scan at exactly the same time, offset the time the scan starts slightly so they aren't all running concurrently. I realize that I could create separate schedules, but that's quite a bit of administrative overhead for what is hopefully a reasonably simple option to include?