@ZiggyStardust32 - again, my apologies for you’re experience. I am aware of the support teams responses now that you provided ticket information, thanks.
As a senior solution engineer and specifically working with various RMM platform partners, yours included, I’ve worked with many customers as yourself who have to deal with the nuances of our how agent works. It’s not perfect, but the efficacy for stopping malicious activity is first and foremost the focus.
- The policy polling is set to 15 min
- This is best practice suggestions, so that’s great. - Moving it to Unmanaged doesn’t do any good because it has lost contact with the GSM
- The agent does not communicate directly with your specific admin console, rather it communicates directly with a series of back end server farms depending on the function. Policy assignment is not arbitrated through the same method as agent commands and if the agent key is set correctly, then policy assignment works separately and will be applied. To speed up that process, simply select the “Refresh configuration” in the system tray icon or use the -poll command. - You don’t quite understand how Webroot handles Excludes. It scan everything even if it is “Excluded” then looks at the Exclude AFTER it scans it do decide whether or not to ignore the results. What is it about the word “Exclude” that Webroot doesn’t understand?
- Fully aware of how the agent works, scanning is just one of the shields and not the primary method for determinations. What you describe appears to be a path override, which the agent has to scan the entire directory to gather the PE binaries to determine if any malicious code was dropped in the directory and compared against the setting “detect if malicious”. If this setting is not checked, it will attempt to ignore these binaries. The agent does NOT arbitrarily ignore any directory that is configured as override, so that is correct, which if there’s a specific application/exe/dll that is important and part of a line-of-business application, then it’s suggested to create that binary as an override vs a path override, which is handled different. Direct binary or MD5 overrides are fully ignored and instantly available via the console. Path overrides are a bit more nuanced. - You are saying the bottom line here is to contact support. Been there done that. Useless.
- It appears support provided answers that were satisfactory and worked. - 9.0.27 might fix the uninstall error but add the problem with the WRSVC service not starting because of a digital signature error. Typical of Webroot. One step forward two steps back.
- Actually, the service enablement registry key has been there for some time. If it was disabled, for reasons unknown, 9.0.27 simply respected that setting. I’ll research this more to fully understand the situation, but a clean install may have been in order for problematic systems like this. The core KEXT and Binaries we supply are fully legally signed & certified by MS. The reg flag is a technical workaround MS caused, but the code is fully digitally signed. - The policy is set to add it. It just doesn’t. This has been going on for over a year and Webroot refuses to address it.
- The installers have not changed in years for sure and it’s usually requested to be removed, not added. 99% of MSPs request to have this removed. Can research more, but adding it for local use is not something that’s been requested, which is why it’s off by default. - See #5 above. This is a known issue with 9.0.27. Call support and reference ticket# 308239
- It’s not a known issue with 9.0.27, it’s a previous issue that was simply being passed along to 9.0.27. Fresh install would have rectified this. Not a great answer, but since the agent is 5mb, reinstall usually it’s that much of a problem. - Call support and reference ticket# 306966
- No need, I’m just one floor up from that team. 8-) - I have reported the suspect program 12 times over the last two years and once again Webroot doesn’t do anything. Is ignoring things by design too? The need to listen to people who take the time to tell them that a false positive needs to be corrected.
- You’re welcome to provide the solution and/or binaries in question directly to me and I’ll follow up with our threat team. Our threat team builds rules to combat updated binaries, but it’s not 100% perfect, so updates are often required. If you export the CSV from any of the “Undetermined” reports, I will follow up. scooper@webroot.com
Again, my apologies for your experience. While I can understand your frustration, there are limits to the millions of technical challenges and variable with a security product, keeping endpoints safe and its management functionality.
