Secure Cloud

Hi there,I am wondering if anyone else has encountered this issue and has any advice:Every time we push a phish test, we have partners forward the phishing email to our help desk. What we discovered recently is that when someone forwards the email our outbound mail filter “clicks” the link.I have discussed this with our spam filter and there is no workaround. They have to protect their IPs from being blacklisted as a source of spam.I’m just curious if anyone else has encountered this and ask what you’ve done.Seems to me the only way to prevent this is to educate users NOT to forward the emails. But we also don’t want to discourage partners reporting security concerns.Open to suggestions. What do you guys do?

Anyone seen a guide for interpreting the wrlog.log?

I have been running quarterly phishing simulations to keep our users on their toes. I noticed that a handful of users are flagged as deferred in the Campaign Phishing Line Data. Do you often have deferred emails to your users? Do you care about them? Should we do anything about this? Thanks!

Hi All.  Any idea of when we will be able to clean up our consoles by removing sites that has been deactivated, as well as endpoints? We have hordes of these across the years using Webroot, and it is making my OCD itch.  

I am using Management ConsoleCE 22.4. Just created a new site-only admin, and assigned admin permissions on that site only. However, after logging in to the new admin, the new admin can view the list of all other admins.Is it a bug in the Management Console? 

Hi,I was wondering if there was a way to manage individual access control settings via policies. I’m aware that the gui can be locked completely as well as removing the tray icon, but I’m looking for a more focused approach. The specific setting I want to manage and prevent changes to is in the screenshot below:Is there a way to disable this one option from the web console and prevent end users from changing it?

Hi. I’ve seen a few posts about contacting support to remove Deactivated Endpoints, is this still the case or is there a new way to do it?My OCD hates seeing deactivated endpoints for machines I no longer support!Thanks.

Hello,I’ve used Webroot for almost a decade. It absolutely the strongest protection out there. I have never, ever, not even once, had a virus infection that I had to remove. It always blocks it. I love Webroot… except….The bad news… it DOES cause Windows slow down a LOT. This has plagued Webroot for years… really ever since I initially recommended it to a former employer and convinced them to switch to it back in 2013. They now have it deployed to several thousand endpoints.I would really like Webroot to focus on improving the speed. There are unnecessary things that occur in the WR client, such as when there is a directory exclusion set in the console, the WR client re-scans the entire directory every so often, finds all EXEs, and re-determines its status even if the directory is excluded. Many processes are tracked, whether excluded or not, and it still runs through its system, it just doesn’t alert on the issue. This is just one example of unnecessary process

I have a user having issues and the only thing that changed was installing webroot.  I want to disable the agent remotely to see if the users notices a difference.  I created a test policy that allows the agent to be shutdown.  Is there a way I can run a terminal command to shutdown the agent?

Hi there, I’m not seeing this in the documentation, but figured I’d ask here just in case I missed something. We would like to be able to send SAT reports directly to our partner point of contact after a phishing/training campaign ends. As far as I can tell this is not possible if we are using the centrally managed portal or Autopilot.Right now all I can do is have them delivered to me in an email. Just had a meeting this week with our account management team, and this is a big source of frustration for them. The phishing and training modules are fantastic, we are just looking for a better way to communicate results with our partners. Thanks!

Hi all, wondering if an ‘open’ in SAT is an actual open if the client is using Outlook’s preview pane. Research shows some say yes, some say only if images are allowed, some say no, one says to ignore it because only clicked links should count. But specifically within Webroot’s Security Awareness Training, if a client is using Outlook, does ‘open’ in a campaign include people who see it in preview pane only? ThanksFranco

I am getting below error while installing sql services on my windows server 2016 machine.(13) 2022-05-16 05:19:09 Slp: Sco: Attempting to open registry subkey {145996FC-8E6B-47AB-BEA5-A84F12B72AF5}(13) 2022-05-16 05:19:09 Slp: Prompting user if they want to retry this action due to the following failure:(13) 2022-05-16 05:19:09 Slp: ----------------------------------------(13) 2022-05-16 05:19:09 Slp: The following is an exception stack listing the exceptions in outermost to innermost order(13) 2022-05-16 05:19:09 Slp: Inner exceptions are being indented(13) 2022-05-16 05:19:09 Slp: (13) 2022-05-16 05:19:09 Slp: Exception type: Microsoft.SqlServer.Configuration.Sco.ScoException(13) 2022-05-16 05:19:09 Slp:     Message: (13) 2022-05-16 05:19:09 Slp:         Attempted to perform an unauthorized operation.(13) 2022-05-16 05:19:09 Slp:     HResult : 0x84bb0001(13) 2022-05-16 05:19:09 Slp:         FacilityCode : 1211 (4bb

Loving to use Winget (sorry, no Wingate) for all software installed upgrade, I found for my surprise that it detected Webroot installed under Webroot SecureAnywhere (Installed Webroot Endpoint Protection v9.0.32.60)And it says (as you can see) ‘Successfully Installed’, but Webroot Console online says nothing change. Soo… I don’t know what’s going on.Hope they fix it in the near future, since there is no easy way from WEBROOT to update antivirus, not even force to update, not even in the console.. the only antivirus at any level (personal or enterprise edition) that I know for decades that doesn’t help you to update their product in any easy way. Go figure. 

Is it possible to disable the training modules and only send out phishing simulations?  I don’t want to annoy customers with a bunch of training when all they want is to test if their employees are clicking through phishing emails.

Hello everyone,My company is using Webroot SecureAnywhere for Business. We are trying to deploy an application that may require us to turn off webroot. Everything I’ve seen shows how to do so manually via the client’s GUI. This is too time consuming as we have dozens of endpoints. Is there a way to shutdown webroot via powershell (or any other automated way), install what I need, then turn it on again? I know the security implications of this and understand why this may not even be possible. But I just wanted to make sure.

Hi there!We’ve been testing Autopilot internally and really like it so far!The only complaint I’ve gotten so far is the training email looks a lot like a phish. Sketchy looking domain, long link of gobbblygook, unsolicited email asking to click something…This is basically the email we’re training our clients not to click.Is there any way to customize this email template? Or are there plans to make it look more official?We are pretty excited about Autopilot, but are hesitant to push the training piece as is. It’s sure to generate a lot of questions from our clients. Thanks!Matt

HelloI am setting up the course ‘Security Awareness Training’ for a company we provide IT support for. According to this guide https://answers.webroot.com/Webroot/ukp.aspx?pid=4&app=vw&vw=1&solutionid=2938 I need to add ‘Secops Mailbox’ in order for the training to work.  It is my understanding that flagging a mailbox as ‘Secops’ just opens the mailbox up to any rules I then put into Phishing simulation. I just wanted to confirm this is the case and that there will be no adverse affects from flagging the mailbox as a ‘Secops’ mailbox. I am changing 30 or so mailboxes so wanted to double check before finalising the settings Thanks in advance :) H

 Some of our endusers (not all) are experiencing problem with the Webroot Web Threat Shield extension in Microsoft Edge (the new Chromium based version). They get a request to enter the keycode. That should not happen, as the environment is fully managed by us as MSP. Is this a known bug?

I saw a Whats New post that talked about the WSAT Autopilot being released. I can’t find it in my console. IS it available yet?

Hello, Recently we have seen fileless malware come up on some endpoints. PowerShell is launching a script that loads a text file, that spawns a remote connection back to an attacker.I understand the Evasion Shield is supposed to detect this. Is there a way we can block PowerShell scripts with Webroot, or even better, where we can be alerted if a PowerShell script launches, or can we block it, etc? Thank you

MSP here using endpoint protection.Problem 1 - For some reason my Webroot clients never update, on any computer. I always have to install the latest WRSA.exe installer manually. This has been going on for over a year.Problem 2 - I installed the latest, 9.0.32.60 a few minutes ago. Upon inspecting the WR log files, I found that Webroot is blocking itself when updating/installing.Blocked: Webroot Process ""C:\Program Files\Webroot\Core\WRSkyClient.x64.exe" 

Hi,I have many part-time employees that do not have a company AD account and email address as their job functions do not require it. What is the best way to get them into a Campaign since public emails are not supported? I’m not going to create 100+ email accounts (and train those employees on how to use/access company email) simply for training modules.Thanks in advance for any ideas.

I am getting this error in the Windows Event Log on my server - it is happening with high frequency…WRCoreService.x64.exe Exception code: 0xc0000374OS = Windows Server 2016 1607Can anyone help me solve this issue? 

We have a couple of thousand people registered across our client base for phishing tests and really like being able to distribute the phish emails over the course of a couple weeks. They just all deliver at once. I contacted support, but wasn’t able to get a clear answer as to why this happened aside from a potential lack of available resources to handle the campaign. I’ve been told this is resolved now, but haven’t tested beyond a small subset of people. I’m not saying support is wrong. We just get a lot of support calls when all of these go out at once, so I’m a little gun shy. Before I shoot out another campaign, I’m just curious if anyone else has seen this behavior. Thanks!Matt

Hi, Has anyone had any success in adding their own logo to the SAT Training Invite emails please? Is there a maximum size for the logo?Thanks