Endpoint connected, but policy ineffective (Win EPM)

Question

Hello,I have a CloudShare Based Windows Server 2022 VM with EPM Client, Adapter and Package Manager installed. It is visible in Pathfinder as connected, up to date, with the right policy assigned. When I update policy at the endpoint it says the latest available version is present. I am using default Workstyles (High, Medium and Low Flexibility) and created one user (at the endpoint) for each Workstyle. I defined filters with the specific user names and SID’s in each workstyle. However, the policy seems to have no effect.I compared behaviour of High and Low Flexibility account. I tried installing basic software (e.g. 7-zip) - both are getting error: Access is denied. I tried running regedit - both run it, but have access denied to the same entries. I tried creating a new folder in Program Files, and got Access Denied. The Analytics tab in Pathfinder shows no activity at all. In short - everything acts if EPM was not there at all, although all connectivity seems to be fine.I suspect I might have defined Account Filters wrong, but don’t know how else to specify users the policy should apply to - I put there user name and SID of a single user . The license is valid. What else should I check?The matter is urgent - I have been debugging other issues for the last week and I’m short with time now. I will appreciate your help very much.

Jens Hansen · Answer

​Hey ​@TomaszKIt’s difficult to say without seeing the policy, filter and accounts and SIDs to validate.But is you are testing on a single client, I usually just use a local policy setup, it is a lot fast than managing the policy through the PM Cloud and wait for policy update. Ask BT to provide the guide for setting up the local policy, It was once a KB and it will speed up testing significantly.It requires the good old GPO policy Editor think latest is 26.1,a change in registry and a true local Admin account not affected by policy. Make sure to have the GPO Policy Editor installed before the steps below.Run Services as a different user (Local Admin)Stop the Avecto Defendpoint ServiceRun an Elevated Command Prompt, using your local Admin. (Service stopped, EPM policy no longer applies, Normal UAC will be shown.)From the command Prompt run regeditChange this key to be LOCAL instead of WEBSERVICEHKEY_LOCAL_MACHINE\SOFTWARE\Avecto\Privilege Guard ClientREG_SZ PolicyEnableRun MMC.exe with Admin rights.Add the Privilege Management Settings Snap-inIn the MMC, highlight Privilege Management Settings and click import policy or use template.Once imported, Enable the Avecto Defendpoint Service again.This setup will allow you to make changes that instantly applies to your system. and is useful for rapid testing, no need to wait on policy refresh etc. a change here is instant.Kind regards​Jens​

Endpoint connected, but policy ineffective (Win EPM)

1 reply

Badge Earners

Badge Earners

Sign up

Login to the community