Jump to content

Endpoint Protection Protection Update Mismatches


Recommended Posts

Now that the cloud console shows versions....i have multiple endpoints reporting back different versions even after a "check for update"  was run. see my screen shots....this is just 2 examples...i have many more.

Capture.thumb.PNG.d5c798ab0efa9c71e496f69b9dc8b287.PNGCapture1.PNG.c6c397dd45891fe50e9fe491be5afa1f.PNGCapture2.PNG.722a6d69e9f6cd5a2b71866308b0afa2.PNG

Capture3.PNG.d0a4a05708f150c7d609d34a1ed000d9.PNG
 

 

 

 

Edited by TonyCummins
added screenshot
Link to post
Share on other sites
  • 2 weeks later...
On 2/20/2018 at 9:23 AM, vbarytskyy said:

@TonyCummins

The units should update when a scan is performed. Make sure your scan schedule is correct. 

Also, at times updates are applied with reboots, make sure to perform a reboot if these computers have not been restarted in a long time. 

 

Thank you. 

 

What do you mean by making sure your scan schedule is correct? Also the PC s get rebooted daily.

Link to post
Share on other sites
1 hour ago, IT_Guy said:

I noticed this across most of my endpoints as well, it took some time before I could find two with matching version numbers. I scheduled a protection update to see if that helped. Haven't checked back since.

When you say you scheduled a "protection update".....do you mean a scan?  I'm not seeing how i can create just an "update schedule".....maybe im just not seeing it !

Link to post
Share on other sites
22 minutes ago, TonyCummins said:

When you say you scheduled a "protection update".....do you mean a scan?  I'm not seeing how i can create just an "update schedule".....maybe im just not seeing it !

Click on an endpoint, in the bottom right corner is a button called "Related Tasks" under there you can schedule a "Check for Protection Updates"

This can also be done if you go to the Endpoints overview screen, click the blank checkbox in the top left to select all your endpoints, then click on Actions and under there "Check for Protection Updates"

 

You can also schedule scans in this area.

mwb.jpg

 

Looks like you already found this, and found that it doesn't do anything.

 

Edited by IT_Guy
Link to post
Share on other sites
1 hour ago, IT_Guy said:

Click on an endpoint, in the bottom right corner is a button called "Related Tasks" under there you can schedule a "Check for Protection Updates"

This can also be done if you go to the Endpoints overview screen, click the blank checkbox in the top left to select all your endpoints, then click on Actions and under there "Check for Protection Updates"

 

You can also schedule scans in this area.

mwb.jpg

 

Looks like you already found this, and found that it doesn't do anything.

 

Yep...i was using the endpoints overview screen...don't seem to make a blind bit of difference as they do not have matching versions which tells me the check for update is doing nothing!

 

[off-topic]
Did i read elsewhere that you disabled tray icon to try stop some of the memory leak? Have you any luck with that?

Link to post
Share on other sites
1 hour ago, TonyCummins said:

Yep...i was using the endpoints overview screen...don't seem to make a blind bit of difference as they do not have matching versions which tells me the check for update is doing nothing!

 

[off-topic]
Did i read elsewhere that you disabled tray icon to try stop some of the memory leak? Have you any luck with that?

I did disable it and have had fewer reports of people complaining about slow machines. I haven't been able to specifically identify a successful case, but since nobody used the function and it was apparently detrimental to some, I removed it. I suppose if you have end users that need to frequently scan things you could create a separate profile for them with it enabled.

Link to post
Share on other sites
1 hour ago, IT_Guy said:

I did disable it and have had fewer reports of people complaining about slow machines. I haven't been able to specifically identify a successful case, but since nobody used the function and it was apparently detrimental to some, I removed it. I suppose if you have end users that need to frequently scan things you could create a separate profile for them with it enabled.

Yea, I  don't have any users that "need" to do local scans assuming its auto protecting etc....i guess i kind of used the tray icon as a means to determine if endpoint was being protected or not as i walked the campus

Link to post
Share on other sites

Yeah at first I thought that was a good way to determine if endpoints were being properly protected, but then I found you had to actually hover over the icon to see if you had "Malwarebytes" or "Malwarebytes Endpoint Protection", the icon popup would say different things depending on how much of Malwarebytes got loaded properly.

And even then the "Malwarebytes Endpoint Protection" doesn't guarantee it's working, just that it looks like its working.

Link to post
Share on other sites
14 hours ago, TonyCummins said:

Turning that tray Icon off has helped ALOT ! even in the short period of time i'm testing.

Agreed, I've had almost no complaints about endpoints since I've turned it off, and the complaints I do get are usually Adobe memory related now.

Link to post
Share on other sites
4 hours ago, IT_Guy said:

Agreed, I've had almost no complaints about endpoints since I've turned it off, and the complaints I do get are usually Adobe memory related now.

Have you noticed even though its turned off that its still showing in task manager and using system resources !
endpoint-tray.PNG.89a52b4a348936b38bbb449e6fd6f714.PNG

Link to post
Share on other sites

@KDawg

Can you shed any light as to why i'm seeing this after disabling it in the policy for my endpoints. Disabled it initially in the hope of freeing up system resources from MBAM.

 Capture.PNG.d6441975c8ce853fc84babfccfec9dbe.PNG

The policy has been in effect over a day and pc restarted multiple times since and also "check for updates ran from cloud console.

Link to post
Share on other sites
  • 1 month later...
  • Staff

The endpoint tray is still used for other processes in the application, there will still be event viewer entries and the process will be there, it just will not display in the system tray.

Additionally, the refresh assets and check for protection updates will not update the new version fields, sending the machine a scan will which is what Vlad was trying to point out. The fix is coming. Yes I get it, it's another broken feature, spare your trash talk.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.