Questions on 'Block Network Activity' setting for the Symantec Management Agent

Products

• IT Management Suite

Issue/Introduction

 The following are few questions asked regarding the "Block Network Activity" setting for the Symantec Management Agent that is seen under Agent Settings > Global Options > Block network activity as seen here:

   

Environment

ITMS 8.x

Resolution

Question: Do these settings prevent clients from getting policies, and do you need to run something on clients asap when this is set, and does a task have to be used to get around this?

Answer: Unfortunately, tasks cannot be used to get around this because the Task Agent also respects the blockout settings. However, there is a workaround from the client side - if you need to download the policy regardless of a blockout that is set, then use the buttons in the UI (“Update Configuration" and send "Basic Inventory). Once the configuration is updated, the packages will appear as “Waiting for download”, and you will be able to override this by selecting the desired package and click the “Download” link in it’s “Package Tasks” section on the window left-side.

Question: It appears network activity can be blocked for up to 12 hours. For each interval selection is the blockout removed when the time interval is up and expires?

Answer: Correct.

 

Question:
-Does the setting survive hibernation/standby, and pick up the timer from where it left off, or is it reset?

-Does the setting survive logoff/logon, and pick up the timer from where it left off, or is it reset?

-Does the setting survive restart, and pick up the timer from where it left off, or is it reset?

Answer: Blockouts are stored in the registry and should survive the power off, hibernation, logoff/logon and restart events. There are no timers as the settings are stored as time intervals and these are correctly respected.

 

Question: What, if any, controls are available in global or targeted settings on the Symantec Management Platform (SMP) server to control or disable these? I don’t see any.

Answer: Blockouts can be controlled centrally in the client policies and the SMP side blockout period is stored the same way as agent side blockouts – in the registry and again these survive any logoff/shut down/ hibernation etc events.

Blockouts from the SMP side could be given from 1 minute up to 24 hours in duration, starting from some given time. The blockout is “day-based” and does not have any date options.

On the SMP side you can go to the Targeted Agent settings > Blockouts tab. There it is a possible to add blockouts. Two fields are available: Start time and Duration. Based on that data, the start time and end time are calculated later by agent when received. At the same time there is not a way to disable blockout options on the client side. Also, there are no plans to change this in the near future.

 

Additional Information

Configuring the Targeted Agent Settings (see the Blockouts tab)

Targeted Agent Settings Page (see "Settings on the Blockouts tab")