Lockdown feature - questions about use

Question

Hi, 
 
 we're planning to use Lockdown on Windows Servers with intercept-X installed. 
 I have some general questions about that feature. 
 1. How long does it take to unlock a server before installing new software? 
 2. Can I stop the Lockdown process - if yes: how - after I started it? How long does it take to stop? 
 Imagine scenario: Disable Lockdown, install new software, re-enable Lockdown, you notice you forgot to install an other software and need to do that asap, you want to stop the Lockdown process. 
 3. How does Lockdown work for fileservers where I have huge shares (multi TB) that contain installers?

RichardP · Answer

I reached out to our lockdown expert and got this reply:

1. How long does it take to unlock a server before installing new software? Once the unlock command has been received by the server, the unlock process should take seconds. You should expect to see a status change in Central for an unlocked server within 60 seconds.

​

2. Can I stop the Lockdown process - if yes: how - after I started it? How long does it take to stop? No, once it's initiated it can't be cancelled. Hence the 'Lock Down' message we display when choosing to Lockdown

3. How does Lockdown work for fileservers where I have huge shares (multi TB) that contain installers?

If the installers are for clients, then it should be fine as the data is just being read. As soon as you start to modify the installers, try to delete them you will have issues. It depends what else is being hosted, as we state in our FAQ: 
 
 =============== 
 
 Is Server Lockdown suitable for all server environments?

No, Server Lockdown is not suitable for all server environments as it will prevent certain actions from taking place. For example, if you host scripts on the server that are regularly updated or host an application used by other computers where data is regularly modified/updated.

It is recommended that you test Server Lockdown in your environment to confirm suitability. 
 ===============

Also note, any new installers/files added to the share will not be covered by lockdown unless they unlock/lock. 
 If these are for clients only and not for running on the server they could add them to the Block list. They will still be added to the baseline so are still protected from the standard delete, modify actions

RichardP · Answer

A slow down is expected and turning off Lockdown and turning it back on won't help. The issue is that Lockdown is indexing the system - and it will have to when you turn it back on. 
 The only scenario where it might speed up a bit by doing this is if the updates modify the same elements in sequence: 
 
 update 1 touches file A 
 We index 
 update 2 touches file A 
 we index again 
 
 However, I think that you will have a higher cost by turning off then on again because you will have to re-index the entire system. 
 I will bring you comment to the PM and Dev team to see if there are optimizations we could include in the product to bring that time down.