Prev: super size me
Next: VMware ESXi
From: JD on 24 Sep 2009 14:07
Hi

Have a new install and the alerts are driving me mad! We have sophos
installed across the network and it is all working well, but the sbs console
is reporting that we have no anti virus software installed. The backup alert
doenst realise that we have another backup product installed. Is there any
way of turning them off or getting the system to recognise Sophos?

ta!

From: "Robbin Meng [MSFT]" on 28 Sep 2009 06:03

Hello,

Thanks for your post.

We have seen that Sophos antivirus does not register all the needed fields in WMI that we use to query to find out the AV manufacturer, name and version. That is why we
most likely cannot properly report for those machines. If this is the case, then there is little that we can do at this time. However, you should check the other basics, like WMI
connectivity from the server to the client.

You can see this using WBEMTEST and connecting to one of the workstation in question to the \\client\root\securitycenter2 and then looking at the classes, antivirus product,
instances, and the go through the populated fields, compare that to one of the working machines if any.

From the server, open an admin cmd, and try "net view \\client" , do you get an error? If this works, then try "net use * \\client\c$", does that work?

If this doesn't work, then review the error, the clients may be not properly on the domain, time could be wrong, name resolution could be wrong (the machine name resolves to
another ip for another machine in DNS), or the workstations have a broken secure channel.

If accessing the client through SMB works, then move to testing WMI.

a. Start - Run - Wbemtest
b. Click Connect
c. Type in \\ClientComputer\root\SecurityCenter where it says root\default or root\cimv2 and click OK.
d. Click Enum Classes. Leave everything as it is and click OK.
e. Double-click AntivirusProduct (or AntiSpywareProduct)
f. Click the Instances button.
g. Select an intance.

Using WBEMTest user interface
http://technet.microsoft.com/en-us/library/cc785775(WS.10).aspx


Hope this helps.



Best regards,
Robbin Meng(MSFT)
Microsoft Online Newsgroup Support

==================================================================
Please post your SBS 2008 related questions to the SBS newsgroup on Connect website:
https://connect.microsoft.com/sbs08/community/discussion/richui/default.aspx

Please post your EBS related questions to the EBS newsgroup on Connect website:
https://connect.microsoft.com/ebs08/community/discussion/richui/default.aspx

If you want to use a newsreader other than a web forum to access these newsgroups,
please refer to the following blog to apply NNTP password and configure a newsreader:
http://msmvps.com/blogs/bradley/archive/2008/11/02/signing-up-for-the-sbs-2008-newsgroups.aspx
==================================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
==================================================================



 | 
Pages: 1
Prev: super size me
Next: VMware ESXi