ESET Endpoint 5.0 Lost Clients

[splansing]

I have some clients that, through the miracle of several admins attempting to master the (inexplicably complicated) interface of the remote console, are lost to the system. They do not report to any console that exists. My question is, if I cannot alter those clients (by simply modifying that registry value, which seems like it would work, if I can shut down the serivces using the key or run the change as that service somehow), is there some way to hijack the standard setting for the update server, so that those clients end up pulling updates from my server instead of trying to pull directly from ESET? Can I fool them with a local DNS zone or something to get them connected? And if they pull updates from my server, will they show up as clients? Or does that require that the remote console setting be explicitly set. I suppose if I could at least have the clients pulling updates while I sort out recovering them via push installs, that would be something. So, can I just hijack the ESET domain name with my own DNS server, and get them updating at least?

[Marcos]

If using a logon script to run a support tool on those computers is a viable option, let me know and I'll PM you with further instructions.

[splansing]

It depends what the logon script does. Ideally I'd like a logon script that could change the RAClientServer registry value to the name of my server, and do nothing else. But of course the registry keys are protected. Perhaps there is a way to run the registry editor using a password or something that will allow me to set that key?

[AmbientSam]

I too would be very interested in this login tool. We are in basically the same boat.

[geoscha]

Yes, I need to do exactly the same thing. Are you able to PM me about this too?

[Marcos]

Originally Posted by splansing

It depends what the logon script does. Ideally I'd like a logon script that could change the RAClientServer registry value to the name of my server, and do nothing else. But of course the registry keys are protected. Perhaps there is a way to run the registry editor using a password or something that will allow me to set that key?

The tool would accomplish that. I'll need to get an xml with a proper configuration of your ERAS that will be to imported on the clients after running the tool. The tool will work for a limited time for security reasons.

[BrandonP]

Hi Marcos,

Are you still able to create this tool? I am working on a large network where the admins deployed the client without specifying the ERAS server. It would be a huge help to be able to do something like this.