NathanMitten
-
Posts
6 -
Joined
-
Last visited
Content Type
Events
Profiles
Forums
Posts posted by NathanMitten
-
-
2 minutes ago, schester said:
I just saw this from LabTech support:
Hopefully that helps you @NathanMitten or someone else!
I'll give that a try. I'll have pick a guinea pig as previous attempts to kill the mbamservice when it was on .03 locked up the computers completely =(
-
2 minutes ago, schester said:
Once the fix was released, I waited a few hours before getting in to check things. And, quite honestly, our LabTech server was also being blocked by mbam, so I couldn't get in to really check anything. After about 3 hours when it seemed clear that it wasn't going to solve itself, I found a way into the LabTech server (was able to remote desktop from another device on the same subnet, but couldn't remotely), I was able to get mbam fixed on there. Once I got it fixed, I gave things a few minutes and then found most of the clients were checking in.
I *assumed* if they were checking into LabTech, that mbam probably wasn't causing a problem on them. I spot checked a few and of the online agents they all had v12 or v13 of today's definitions. The agents that weren't showing online had v02 (mostly or exclusively) definitions.
I ran a search for LabTech last checkin >1 hour and <1 day to give me a list of agents that weren't checking in. Some of those had gone offline for other reasons and there was only 5% or so that I needed to go through.
If the agents are checking in, but not getting mbam updates, could sending a restart script to all of them help?
In our case it is really only the .03 update that is an issue. All the other versions updated to v12 and v13.
Are you using MBAM plugin with Labtech or do you have a separate MB management console? I had no issues moving policies within the management console, even if LT and SC were not working. Problem with the plugin is there isn't any good way to force it to another policy because the command is coming from the labtech agent. It was hit or miss on if I could change the computer policy via the plugin or not. If I could then a reboot would work, but I couldn't reboot them via labtech.
At this point we are looking at around 60ish manual uninstall / reboots.
-
49 minutes ago, schester said:
I've found that disabling the website blocking, then updating the database fixes the problem and the website blocking can be re-enabled. No restarts are needed, but we are running 1.80 for MSP, so it could be different for others.
What I can't figure out is how to do this on all the machines that we can't talk to because of this issue. Has anyone found a viable way to tell the remote devices to update? The impacted devices don't seem to be checking in to LabTech/Automate.
We were about half way through migrating clients from a normal MBAM console and the MBAM plugin with Labtech. The ones that are on the console I didn't have any issues changing policy, updating and changing back.
However, clients in the RMM plugin I've had less luck finding any method to make work, they report into Labtech, but can't figure out a way to get the policy to update.
-
Just to pass along what seems to be true for us. We have around 4,000 deployed. It seems that machines on the .v03 update will fail to check for updates. Changing the policy did not work, what did work was to create a new policy with no protection, move computers to that policy that would allow them to update to latest def which seems to be working, then we'd move them back.
-
If by fixed you mean the latest def are fixed yes. However, almost all of the machines that have the v03 def will not search for updates.
In order to update these without manually uninstalling / rebooting we've had to change their policy to one with no protection, perform update and then switch them back.
Actually providing information like this would be useful rather than just posting everything is fine when it's not.
issue with malwarebytes
in Malwarebytes Anti-Malware for Business
Posted
No luck, machines aren't reporting to SC at all, it shows blocked in the logs. Did give me an idea for using webroot to either reboot them or see if we can use it to download and run the mbam cleaner file.