SEC 5.5.0 Folder exclusions not pushed out to Servers

Hello Brown-Bear,

just to make sure, do the servers show Same as policy for Policy compliance?
I'm a little bit confused, first you say setup various anti-virus on demand scanning folder exclusions and later selected to configure "On Access Scanning" (emphases mine) - so where/how do you check the various Servers? Guess exclusions won't reveal any secrets so could you provide a screenshot of the exclusions in the policy and another one of the check on one of the servers?

Christian

Thanks Christian,

Sorry let me clarify. Under "Anti-virus and Hips" I have created a Server group with a number of Servers in it. 

When I view edit this policy and select configure beside on-access scanning ...in windows exclusions I have added in a number of folder exclusions and files that I don't want scanned.

When I go to any of the Servers that the policy applies to they don't have the new exclusions I added even after a reboot. They show "Same as policy" with regard to compliance.

Thanks Christian,

Sorry let me clarify. Under "Anti-virus and Hips" I have created a Server group with a number of Servers in it. 

When I view edit this policy and select configure beside on-access scanning ...in windows exclusions I have added in a number of folder exclusions and files that I don't want scanned.

When I go to any of the Servers that the policy applies to they don't have the new exclusions I added even after a reboot. They show "Same as policy" with regard to compliance.

Hello Brown-Bear,

policies are applied as soon as they are received, no reboot required. they don't have the new exclusions - you open the local GUI, Configure anti-virus and HIPS → On-access scanning → tab Exclusions?

Christian

Hi Brown-Bear 

Please share the configuration file(.xml) from one of the servers, from the following path: 

<C:\ProgramData\Sophos\Sophos Anti-Virus\Config\machine.xml

Note: Please send the .xml file via DM

Thanks Christian,Yes that's the way I am checking individual servers

That's assuming it should show in the local GUi of a Server?

Hell Brown-Bear,

for anti-virus and HIPS the policy settings should show in the local GUI (but not necessarily with the same layout). In particular exclusions look like in the policy.

Christian

Update.....

Ok thanks to Haridoss and Christian I have discovered in the .xml file at the following location C:\ProgramData\Sophos\Sophos Anti-Virus\Config\machine.xml actually does list the folder exclusions I specified.

What I can't understand is why they do not show in the local GUI as Christian mentions.

Hi Brown-Bear 

As the exception is listed in the .xml file, it should be reflected in the local UI. Hence please check if you have the latest version of UI (what is the current version?). If the program is up to date and you still have the issue, please open a support ticket through web form or Sophserv.

Hello Haridoss and Brown-Bear,

I beg to differ, the local GUI does show the policy exclusions - don't think what I see are echoes from previous versions. Wouldn't make much sense otherwise, furthermore - TP aside - you wouldn't be able to locally remove an exclusion.

Christian

Hello Brown-Bear,

on second thoughts let's not forget the basic troubleshooting steps:

• endpoints actually communicating? (check Last message time)
• servers in the correct group? (likely)
• desired policy applied to group? (please check, if in doubt edit and save the policy - if the compliance status doesn't change to Awaiting policy transfer ... it isn't)

Christian
P.S.: Once this issue is resolved we should perhaps discuss the plethora of exclusions ... and whether some actually achieve the intended result

Hi Christian

Yes the endpoints are communication and the last message time is 02:42 am this morning.

Definitely the Servers are in the right group and when I do anything with the policy it does change to Awaiting policy transfer and then shows same as policy a few seconds later.

I have checked all my servers and they all have the exclusions listed in the .xml file but not in the local Gui.

Thanks