SMTP Notification Variables

[0verlord]

Maybe this is a feature request more than anything.

Anyone has been able to figure out how to get the username of the infected computer emailed along with the notification.

KB Solutions ID: SOLN58 shows the available environmental variables, however username is not one of them, they say to use anything available running the SET command. I tried this and my case using %USERNAME% returns "NT AUTHORITY\SYSTEM"

In a large network with hundred of nodes over 5 servers, a netbios name becomes pretty tedious to track down. Even an IP address would help, as then I would know which subnet i can start looking at.

Thanks.

[Marcos]

If a threat is detected by the startup scanner or during a scheduled scan, the %UserName% variable will resolve to "NT AUTHORITY\SYSTEM" as the scans are run in the local system account. If there's an account with full permissions to all folders and registry keys, you could try configuring the ESET kernel service to run under this account instead of LSA, but it's not recommended.