Temporarily disable AV

(imported topic written by FrederikBraad)


I’ve gotten a request from a customer using TEM Core AV, who wants an easy way to temporarily disable AV on a machine, for troubleshooting or specific installation issues. - Either locally via a script or something, and/or as a fixlet.

You would you go about creating such a fixlet? - Would you disable scheduled and real-time scan, temporarily exclude all folders, or is there a better way of doing it? -And could you somehow make a time-limited fixlet, that automatically reverts after perhaps 24 hours?



(imported comment written by Xie_Ran91)

Most likely, this could be a fixlet or a wizard which helps you configure the policy. I will file a RFE for this.

(imported comment written by FrederikBraad)

Good idea. I will definitely do that. Thanks.

Until then, I think we need a temporary solution. -So any ideas would be appreciated. :slight_smile:

(imported comment written by Xie_Ran91)

Here I attached a custom fixlet which restarts the two CPM services. You can check the action and read the comments, then copy out the parts which disable the scan services.

Note: the self-protection needs to be turned off in order to turn off the scan services. This is also in the fixlet action attached here.

(imported comment written by FrederikBraad)

Perfect! Thank you!

I will try to build something based in this.

FYI: I have also posted an RFE on the feature: