Joseph 0 Posted September 7, 2013 Share Posted September 7, 2013 (edited) Someone asked me for this earlier so I packed it up and uploaded it if anyone needs it. It's just a script that creates a dummy av called AV Exlcude It will allow you to exclude a workstation or server that cannot have AV on it and will not show up as "Missing Anti-Virus" The device will have the date excluded as the definition date and will have a text file with the date, user, and reason for exclusion. The detection template uses this file. You can easily just delete it to de exclude it or create a EDF check box to set or unset it. Update 3/18/15 Just updated the file on here, it's the version that updates the current date as the definition and shows auto protection is on. AV Exclude v2.zip Edited March 19, 2015 by Guest Quote Link to post Share on other sites
Greg.Buerk 2 Posted September 12, 2013 Share Posted September 12, 2013 This is AWESOME. I love the out of the box way of making this work. Quote Link to post Share on other sites
starbucksgold 0 Posted September 12, 2013 Share Posted September 12, 2013 Nice job Joseph. I like the concept as this also helps improve on client health scores. Thanks for sharing. -jeff Quote Link to post Share on other sites
scubes13 0 Posted September 13, 2013 Share Posted September 13, 2013 So, I ran this script against one of our machines, but they still show as not having any AV installed. What might I be missing? Quote Link to post Share on other sites
scubes13 0 Posted September 13, 2013 Share Posted September 13, 2013 Oh! Now I see. I looked at the actual script. The first line exits if the machine is not Windows. I have been trying this on Linux machines. Guess I need to dig in and see if there is a way to put in place for a Linux box. Quote Link to post Share on other sites
starbucksgold 0 Posted November 5, 2013 Share Posted November 5, 2013 Joseph, This does work well, however, I have noticed on problem that I am trying to solve. When an agent has the AV Exclude configured it reports as AV Disabled in the internal monitor called AV - Disabled. From what I can tell, this is based on the value in the table 'computers' under property 'virusap' with a value of 0. Problem I am having is each time I change that value to 1 to indicate AV is enabled, the value reverts back to 0. From what I can, this is because the 'virusscanners' table does not have a value for the 'AutoProtect' property. I'm trying to figure out a way to create a fake service that deploys with your script and update the property value with a service name so ultimately it will have a value of 1 in the internal monitor so tickets won't be created for these agents. If you have any thoughts on this before I spend too much effort, please advise. Thanks. -jeff Quote Link to post Share on other sites
MartynKeigher 7 Posted January 27, 2014 Share Posted January 27, 2014 Hey lads, I applied this to my LAB instance yesterday and the install went great and the AV Exclude does show on the agent, however, I'll second Jeff's feedback with "it still does raise an Alert for AV Disabled" I'm going to create a script for the "dummy service" and post it when I'm done... but if you have found a way around the "AV Disabled Alert" by now... then please do share! Thanks Quote Link to post Share on other sites
MartynKeigher 7 Posted January 27, 2014 Share Posted January 27, 2014 Update: No script yet, but... here is how i'm creating that dummy service.... **FYI: I have started the Friendly name with MK, so that all service that i run on the agent are all together in the Services.msc list. That is all. The content of the avexclude.bat is just : CALL C:\windows\explorer.exe - just a simple batch/comamnd. You could probably just point the binPath directly at explorer.exe ? :shock: 3 things: 1) PLEASE correct me if I'm wrong but, the service doesn't have to be running for the Virus Scan definition to work, it just needs to be present. 2) I blacklisted this custom service, so that i dont get alerts about it, as it's just for the sake of the "AV Exclude" functioning correctly. 3) I edited my Virus Scan def to the following: Thanks, Quote Link to post Share on other sites
Michael Priest 4 Posted January 28, 2014 Share Posted January 28, 2014 When I've added this script to systems i have always made duplicates of the AV Disabled & AV out of Date monitor and added an exclusion to the Monitor for anything that is using the Virus Scanner 'AV Exclude'. in my Examples the ID 150 relates to the AV Exclude definition that was added when the script was first run, you can obtain this ID using SQLYog and running the following Query SELECT VScanID FROM virusscanners WHERE NAME = 'AV Exclude' Example - AV Out of Date Example - AV Disabled Regards, Michael Priest http://www.ninitesolution.com Quote Link to post Share on other sites
Joseph 0 Posted February 7, 2014 Author Share Posted February 7, 2014 I got a little curious earlier and tried to figure it out a way to do the definition dates. Seems to work, but I will be able to tell tomorrow once the date has changed. I created a bat file, that just puts the date in the date.txt file, then echo's the path for labtech to read it. This bat is ran automatically when labtech expands the definition location to find the path of the definition file. The location is hardcoded right now because for some reason I kept messing it up but I'll create a script tomorrow when I get some time so it auto creates all of this. Bat file AV template Quote Link to post Share on other sites
Joseph 0 Posted February 7, 2014 Author Share Posted February 7, 2014 that seemed to work! Quote Link to post Share on other sites
MartynKeigher 7 Posted February 11, 2014 Share Posted February 11, 2014 that seemed to work![attachment=0]date.PNG[/attachment] Great addition to the AV Exclude! Can't wait Quote Link to post Share on other sites
Brandon 2 Posted February 11, 2014 Share Posted February 11, 2014 So, I ran this script against one of our machines, but they still show as not having any AV installed. What might I be missing? You probably already figured this out, but after you run the script you need to update the config and resend the software and system info inventory to update the agent. These are located in Commands > Inventory > Update Config, Resend Software, Resend System Info. Also you have to run them in that order and make sure the previous command is finished before you issue the next. Any time you update your virus scanners for example, a new config.gz file is written to your LTShare and that config file is pushed to the agent where it writes the new virus scanner configuration into the registry of the agent. Resending the inventory will check these registry keys and populate your database. Quote Link to post Share on other sites
Brandon 2 Posted February 11, 2014 Share Posted February 11, 2014 I'm going to create a script for the "dummy service" and post it when I'm done... but if you have found a way around the "AV Disabled Alert" by now... then please do share! I'm wondering if it would be easier to just use explorer* as the ap instead of creating a service? Quote Link to post Share on other sites
starbucksgold 0 Posted February 12, 2014 Share Posted February 12, 2014 I setup the Netlogon as the AP Process service to mitigate this problem, so I'm sure using Explorer would work as well. I am working on updating based on the latest information provided by Martyn and Joseph. I like the idea of creating a fake service and haveing and option to keep the defs updated via a batch file. This will keep reports from reflecting negatively in the customers eyes and keeps the overall client health scores up. -jeff Quote Link to post Share on other sites
Brandon 2 Posted February 12, 2014 Share Posted February 12, 2014 The way I've been keeping the defs up to date is using a LabTech script assigned to our AV Exclusion group to write the current date into a text file and overwrite the existing file so the modified date changes. This then reflects on the agent under the defs with the current date. We've been doing this with no issues since the original post. Quote Link to post Share on other sites
MartynKeigher 7 Posted February 13, 2014 Share Posted February 13, 2014 This will keep reports from reflecting negatively in the customers eyes and keeps the overall client health scores up. -jeff Massive +1 !! Quote Link to post Share on other sites
MartynKeigher 7 Posted February 26, 2014 Share Posted February 26, 2014 Any update on this?? Quote Link to post Share on other sites
starbucksgold 0 Posted February 27, 2014 Share Posted February 27, 2014 Any update on this?? Martyn, What update are you looking for on this subject. I've got this working and with signature updates without any issue. I'll be happy to answer what I can for you. -jeff Quote Link to post Share on other sites
slandells 0 Posted February 5, 2015 Share Posted February 5, 2015 HI Guys, I have this installed and working, but no def. updates. I'm being lazy and asking, rather than working it out myself. What did you guys do to get teh def. updates working? Thanks, Stuart. Quote Link to post Share on other sites
Brandon 2 Posted February 5, 2015 Share Posted February 5, 2015 I created an autojoin group that runs a script every day to take care of the definition updates. Quote Link to post Share on other sites
slandells 0 Posted February 6, 2015 Share Posted February 6, 2015 That's actually what I worked out too! Thanks for the speedy reply Quote Link to post Share on other sites
Joseph 0 Posted March 19, 2015 Author Share Posted March 19, 2015 Sorry for never getting back to this, I just added the last one I made. This is the one with the bat file that always shows the current date for the definitions. It's on my original post. Quote Link to post Share on other sites
dsinton44 1 Posted June 7, 2015 Share Posted June 7, 2015 Very cool. Someone mentioned this during automation nation 15. Quote Link to post Share on other sites
FrankVerstraten 0 Posted June 10, 2015 Share Posted June 10, 2015 Thanks for this great solution! Indeed I heard this during one of the session at AN2015 and liked the smart thinking. Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.