What the hell is wrong with MS??!!

Many times we advise end users to make use of knowledge base articles on the MS site. One end user had issues saving files to network drives. It took an unreasonable amount of time to perform the task so the end user went to the MS knowledge base to search for a resolution. What she found floored me.

MS, the clowns who are screaming about their progress in the new "Security Initiative" have a KB article that advises users to *DISABLE* realtime virus protection if saving files to network drives takes too long. Yes, you have read correctly.

Snip:

RESOLUTION
To work around this issue, temporarily turn off File System Realtime Protection, and then save the file. For more information about how to do so, view the documentation that was included with your program.

Here is the actual article.
http://support.microsoft.com/default...roduct=off2003

I have seen infections hit machines in less than a second. This, in my opinion, is wreckless on the part of MS.

Anyway, before you have your end users go off looking to do a little self help, you may want to look at the resolution to the problem before it becomes a security issue rather than a helpdesk issue.

--TH13
:mad:

As insane as that is horse, it wouldn't work in my shop. The end users do not have the ability to disable real time protection, that function is locked down via the management console. If they wanted to disable it they would have to come through me and after I stopped laughing, I just say no. :p

Cheers:

Well, you guys have to remember, in all fairness, Microsoft is so secure otherwise that it can't be infected by virii. Its been almost a week since the last epidemic, and they cut them down from once every two weeks to once a month, or every two months.

Yes, we too are implementing client side lockdowns via the admin console. However, when she walked in with a puzzled look on her face and I asked why I nearly died when I saw the advice. Just think about a shop that does not enforce client-side lockdown policy!

Anyway, I think I will be writing a nasty gram to MS. I'll post a response if I get one.

In all fairness to M$ here it's not technically their fault that some third party vendors product is detrimentally affecting the operation of their OS. They are stuck between the proverbial rock/hard place here. If they don't draw attention to the fact that it's someone elses stuff that is messing with their system then their product will be thought of as a POS. If they do, and tell people how to improve the apparent performance of M$'s product, then all the security types jump on them like you are Hoss...... The one thing they really can't do is to advise that the user uninstall that AV product in preference for another - can you imagine the lawsuits there?

While the advice may seem to be lunacy it would never have been proffered if M$ came with it's own AV. But since they rely upon a third party for this and it's the third party's software causing the problem they don't have any choice but to proffer the advice.

A similar analagy would be someone complaining that they can't network their machines at home any more. Then they reveal that they purchased a software firewall and installed it which is blocking the connection attempts. Unfortunately, the firewall doesn't allow the user to control port access. Microsoft's _only_ recourse, if the client insists on networking the machines, is to tell them to turn off the firewalls. Lunacy? Yes. Fair advice bearing in mind the priorities of the user? Yes.

Some very disk intensive applications will slow down when used on a network share. They probably shouldn't be there in the first place but switching off client side scanning of those files will significantly speed things up. You can place importance on sever side scanning at that point. I don't set any client machines to scan network drives for that reason. I see the point though, you trying to lock down idiot users and microsoft goes and tells them to arbitrarily turn of virus scanning. However that stuff is written for the masses, it doesn't take into account the situation. I absolutely lock down every client via epolicy for that reason. Antivirus does cause problems. All kinds of problems, especially on older PCs. The real issue is fixing the slow access and that is a valid check to see if it's the culprit. With an enterprise virus product like mine you could see within the hour that someone has turned of the scanning featue (if I didn't lock it down). If file saving is really slow, the user could run a risk of losing data, especially with XP.

I have to agree with Tiger Shark on this topic. I am no true lover of any OS. I use what I need to use when I need it. There are are all types of users here on AO, and everyone of them has at least one gripe about at least one OS. I might make a challenge to the people here at AO...

Write your own OS and see how many people complain about yours, or better yet gather the best minds here at AO and form a group to write our DREAM OS. Instead of complaining about it do something about it. IMHO I think that building an OS that anyone can use for anything is an impossibility... Someone prove me wrong... Please. :D

Just my 2 cents worth...

Yes, I see your point but at least they can add in a disclaimer or a warning that disabling realtime virus protection may cause infections. My point lies more with this idea than blaming them because a 3rd party vendor's app slows down saving to network drives. Also, I cannot get away from the fact that they would simply tell someone to disable AV for the sake of speed. I mean, ****, we don't remove our firewall because some numbnutz has performance issues hitting a remote FTP server. Oh well, now I'm all worked up. It's all Tiger's fault! I blame everyone but myself! ;)

Quote:

---

It's all Tiger's fault! I blame everyone but myself!

---

rofl

That's the ticket...

Hoss: That's ok, I have broad shoulders..... ;)

I do understand why you are getting worked up and it is an easy thing to get worked up about.... It's kinda like some consultant coming in and telling all your users not to worry about something you have been trying to drill into them for a coons age...... It just won't sit well with any of us.....

But the other side of the coin is that if you build yourself a nice fast 100BaseT network and along comes a vendor and changes all your switches back to good old 10BaseT hubs you'd probably be a little miffed by the vendor wouldn't you...... ;)

Tiger,

Battlefield montra 101:

Everything that moves is the enemy.

;)

Hoss: ROFLMAO.....

Battlefield montra for WMD: Everything that moves is the enemy.

Battlefield montra for precision guided weapons: Who cares what moves my target is _there_.

PS: I can stand still for incredibly long periods of time...... Old age you know.... LOL

In all fairness I think recommending that you stop on access virus scanning to troubleshoot a network file system issue is sound advice.

If I have any types of issues moving a large item from point a to point b I always go and check the virus logs, if there are any, or stop the auto-scanning and try to move again to see if the issue goes away..

If you are relying solely on your AV software to keep you from getting infected and not using good techniques in disabling common infection points than it is your fault for making your security layer so flimsy...

The only way a properly patched system that does not have any file shares on it can become infected by a virus is for the user to run something that they shouldn't be running. Given that you are talking about a business you should be preventing the user from getting any type of virii to their desktop by having a strong proxy policy in which everything going through the proxy is scanned, as well as scanning all email attachments and blocking known attachments from email altogether.

Quote:

---

If you are relying solely on your AV software to keep you from getting infected and not using good techniques in disabling common infection points than it is your fault for making your security layer so flimsy...

---

Very good point, however, if you have 60,000 nodes, how would you defend against contractors and end users plugging in a laptop that has been infected from external sources? In addition to that, not every department is as vigilant about patching and definition updates.

See where I'm coming from? It's very tough to keep a large userbase clean. It makes it even worse when the leading software vendor on the planet is advising you to disable virus protection without so much as a mention that it may be a bad idea or even more so, a violation of your organization's security policy.

Well it does day "temporarily disable it" :D Actually I think it said just to turn off that related feature. (just giving you a hard time). In a normal business environment where people have the ability to surf poinsoned sites and move around computers and laptops, stoping clients infections is extremely difficult. In less creative business practices that might be more practical. I stake my ass on server side controls and centralized outbreak monitoring. Then if it does get to the client that last bit of software helps in many cases. Somehow a mydoom got through the email filter while stopping hundreds of others. The client plug in for Outlook stopped it when some idiot clicked on the message. :) If that hadn't worked hopefull the on access file scanner got it but it didn't get that far.

Quote:

---

Originally posted
It took an unreasonable amount of time to perform the task

---

Just out of Idal curiosity...what connection speed are you running and how big was the file?
Just another quick question...how did you resolve it? Did you go ahead and kill the RVP and then download or is there another trick?

Only reason I ask is because I have seen that request put on quite a few patches and other misc downloads, but I have never run across a problem with the actual downloading.

Just Curious.

Bio

Quote:

---

Originally posted here by thehorse13
Very good point, however, if you have 60,000 nodes, how would you defend against contractors and end users plugging in a laptop that has been infected from external sources? In addition to that, not every department is as vigilant about patching and definition updates.

---

I have the same concern hoss. Some of us dont have the tools or technologies (much less do they integrate with each other) to have tight security measures at every piece of the network. You have AV on your email server, file server, gateway but these dont protect you (as you mentioned I think earlier) from someone plugging in laptop (or PDA) from home thats infected. If users can disable AV, what protects them when they stick a floppy or CD with infected files on them. By the way, we dont allow users to disable our AV sw however (very) savvy people can get around this and disable it.

Let's face it: the perimeter has been pushed down to the desktop and we must put protections there!

I am hoping that Cisco (and others) initiative where a node cannot connect to the network or is quarantined if it is not running an up-to-date AV or firewall (if you choose). It's called Cisco Network Admission Control (NAC) and looks promising...but we'll see.

<disclaimer> I do not work for Cisco nor own their stock </disclaimer>

Network access based on policy is one of my hopes...and better integrated products (VPNs, dialup, etc) is another.

Quote:

---

am hoping that Cisco (and others) initiative where a node cannot connect to the network or is quarantined if it is not running an up-to-date AV or firewall (if you choose). It's called Cisco Network Admission Control (NAC) and looks promising...but we'll see.

---

We are banking on this technology for all of the reasons above. We even signed up to be beta testers because it will solve so many headaches we currently face. I believe the first release will be ready sometime late this year.

Customer: How long before Microsoft have a patch to stop All these Viriuses?
und3rtak3r: do you have win auto update turned on or do you check for and install MS updates atleast onece a week?
customer: No
und3rtak3r: is your virus Definitions upto date?
customer: no? whats that?
und3rtak3r: that will be $75 for the repair thank you..

the wording of advice, in solutions or tempory solutions to problems, always will be the weakest link. The readers interpretation is where many problems lay. The dumber the reader you try to assist the dumber the text becomes..
the more the problems grow..


cheers

Quote:

---

Originally posted here by thehorse13
Very good point, however, if you have 60,000 nodes, how would you defend against contractors and end users plugging in a laptop that has been infected from external sources? In addition to that, not every department is as vigilant about patching and definition updates.

See where I'm coming from? It's very tough to keep a large userbase clean. It makes it even worse when the leading software vendor on the planet is advising you to disable virus protection without so much as a mention that it may be a bad idea or even more so, a violation of your organization's security policy.

---

I totally agree. My company currently has an employee base of around 75k people and we have a very very hard time securing the desktop. That is why we place a much higher emphasis on securing the other areas of our network. We've taken the standpoint of blocking all traffic from a suspected contaminated computer first, and asking questions later. It is really the only way to deal with non standard infected machines being plugged into the network.

I can see where some clarification of the original technet article would be good for the end users well being. I guess we are not confident enough in our users to tell them to go look at technet themselves. Instead we have built up extensive internal documents and help sites that we recommend our user base go to before calling a helpdesk.