PDA

View Full Version : IA is getting 3rd antivirus user



rgbfilho
2017-09-12, 09:16
Hi guys!!

I have the following issue and I hope you guys could help me.

My customer has a sophos endpoint antivirus on his network. This 3rd party antivirus has a user for update the database. The checkpoint is getting this user instead of a domain user of a machine.

In a real world...Joe is a user using his PC. When he first logs in the Check Point gets his username. After some time the check point gets the sophos username using the Joe's IP address.

The user of a 3rd party antivirus is SophosUpdateMgr.

I found other users facing the same issue as the link below:
https://community.sophos.com/products/endpoint-security-control/f/sophos-enterprise-console/81718/sec-sophosupdatemgr-used-instead-of-the-real-user

aweldon
2017-09-12, 09:26
Could't you just exclude this service account from IA?

rgbfilho
2017-09-12, 09:48
Could't you just exclude this service account from IA?

It is a 700 Appliance with Gaia embebed I forgot to mention that.
I've just enabled the option to permit more the one user for IP address. But I couldn't test yet and i don't think this will solve.