Options page

Standard access mode requires a password to view and change settings on the Trellix Endpoint Security (ENS) Client Settings page.

• Password — Specifies the password.
• Confirm password — Confirms the password.

Changing the Administrator password invalidates the time-based password. If you change the Administrator password, save the policy, then generate a new time-based password.

Best practice: Change Administrator passwords regularly.

Enforces an Trellix Endpoint Security (ENS) Client lockout if the number of failed password attempts exceeds the configured limit.

Specifies the number of failed password attempts allowed. The default is 3.

Specifies the time frame for failed password attempts. The default is 5 minutes.

Specifies the number of minutes to lock the client interface if a user exceeds the maximum number of failed passwords. The default is 15 minutes.

Requires a password to uninstall Trellix Endpoint Security (ENS) Client and specifies the password.

(Disabled by default)

• Password — Specifies the password.
• Confirm password — Confirms the password.

Enables the Trellix Endpoint Security (ENS) Client to accept a time-based password, sets the expiration date and time, and generates a password.

Entering the time-based password enables Full access to Trellix Endpoint Security (ENS) Client. The interface remains unlocked until it is closed.

Best practice: During a security incident, disable the time-based password. After a security incident, change the Administrator password and regenerate the time-based password.

This option is available only when the Client Interface Mode is set to Standard access or Lock client interface.

Changing the Administrator password invalidates the time-based password. If you change the Administrator password, save the policy, then generate a new time-based password.

Best practice: Change Administrator passwords regularly.

Specifies the expiration time for the time-based password. The default expiration time for the password is 11:59 p.m. on the specified date.

The expiration time is relative to the Trellix ePO - On-prem server. For example, if you set the expiration time to 1:00 p.m. PST, the password expires at 4:00 p.m. on client systems in the EST time zone.

If a time-based password is in effect, this button toggles to View Password.

If a time-based password is not in effect (not set or expired), this button toggles to Generate New Password.

Specifies the language to use for Trellix Endpoint Security (ENS) Client interface text.

When you change the language from Trellix ePO - On-prem, the language change is applied to the Trellix Endpoint Security (ENS) Client at the first policy enforcement.

Language changes made from the Trellix Endpoint Security (ENS) Client override policy changes from the management server. The language change is applied after the Trellix Endpoint Security (ENS) Client restarts.

Specifies the action to take when malicious activity occurs:

• Block and report — Blocks activity and reports to Trellix ePO - On-prem. (Default)
• Block only — Blocks activity but doesn't report to Trellix ePO - On-prem.
• Report only — Reports to Trellix ePO - On-prem but doesn't block activity.

Certificates access for the specified processes.

Wildcards are supported.

+ Adds a process to the exclusion list. Click +, then enter the exact resource name, such as avtask.exe.

- Deletes the selected item. Select the resource, then click -.

Specifies certificate options.

Allows a vendor to run code in McAfee processes.

Caution

This setting might result in compatibility issues and reduced security.

Specifies the Signer Distinguished Name (SDN) that defines the entity associated with the certificate.

This information can include:

• CN — Common Name
• OU — Organization Unit
• O — Organization
• L — Locality
• ST — State or province
• C — Country Code

Specifies the location for the log files.

The default location is:

<SYSTEM_DRIVE>:\ProgramData\McAfee\Endpoint\Logs

This location depends on the operating system.

Enter or select a location from the drop-down list:

• System Drive
• System Root
• System Directory
• Temp Directory
• Program Files Directory
• Program Files Common Directory
• Software Installed Directory

The log files (activity, debug, and event) are logged with local timestamps set in your system.

The log files (activity, debug, and event) are logged with UTC timestamps.

(Enabled by default)

Enables logging of all files scanned during an on-demand scan. (Disabled by default)

Best practice: If you enable this option, make sure the activity log file size is set to at least 100 MB.

The on-demand scanner doesn't scan files in the clean scan cache, so the scanner doesn't log those files.

Limits each activity log file to the specified maximum size (between 1 MB and 999 MB). The default is 10 MB.

Windows — If the log file exceeds this size, new data replaces the oldest 25 percent of the entries in the file.

Linux — If the log file exceeds this size, the current file is backed up and a new file is created. The last five versions of the log files are available.

Specifies the language to use for activity logging text.

Automatic — Automatically selects the language to use for activity logging text based on the language on the client system.

When you change the language from Trellix ePO - On-prem, the language change is applied to the Trellix Endpoint Security (ENS) Client at the first policy enforcement.

Language changes made from the Trellix Endpoint Security (ENS) Client override policy changes from the management server. The language change is applied after the Trellix Endpoint Security (ENS) Client restarts.

Enabling debug logging for any module also enables debug logging for the Common module features, such as Self Protection.

Note

Enable for Storage Protection option is applicable only when Endpoint Security Storage Protection is installed.

Limits each debug log file to the specified maximum size (between 1 MB and 999 MB). The default is 50 MB.

If the log file exceeds this size, new data replaces the oldest 25 percent of the entries in the file.

The Windows Application log is accessible from the Windows Event Viewer → Windows Logs → Application.

The location of syslog is configurable on Linux systems.

Specifies the severity level of events to log to the Event Log on the Trellix Endpoint Security (ENS) Client:

• None — Sends no alerts
• Alert only — Sends alert level 1 only.
• Critical and Alert — Sends alert levels 1 and 2.
• Warning, Critical, and Alert — Sends alert levels 1–3.
• All except Informational — Sends alert levels 1–4.
• All — Sends alert levels 1–5.

• 1 — Alert
• 2 — Critical
• 3 — Warning
• 4 — Notice
• 5 — Informational

Limits the size of event databases to the specified maximum size (between 50 MB and 999 MB). The default is 50 MB.

Specifies the use of the proxy settings from the client system, and optionally enables HTTP proxy authentication.

When you select Use system proxy settings, the client system uses the proxy settings configured in Internet Explorer, including support for PAC files.

Customizes proxy settings.

• Address — Specifies the IP address or fully qualified domain name of the HTTP proxy server.
• Port — Limits access through the specified port.
• Exclude these addresses — Don't use the HTTP proxy server for websites or IP addresses that begin with the specified entries.

  Enter the comma-separated addresses.

  Best practice: Exclude the Trellix GTI addresses from the proxy server. For information, see KB79640.

Specifies that the HTTP proxy server requires authentication. (This option is available only when you select an HTTP proxy server.) Enter HTTP proxy credentials:

• User name — Specifies the user account with permissions to access the HTTP proxy server.
• Password — Specifies the password for User name.
• Confirm password — Confirms the specified password.

Displays or hides the Update Now button on the main page of the Trellix Endpoint Security (ENS) Client.

Click this button to manually check for and download updates to content files and software components on the client system.

(Enabled by default)

By default, the Default Client Update task runs every day at 1:00 a.m. and repeats every four hours until 11:59 p.m.

On Macintosh, the Default Client Update task runs every day at 4:45 p.m..

Specifies what to update when the Update Now button is clicked.

• Security content, hotfixes, and patches — Updates all security content (including engine and AMCore and Exploit Prevention content), as well as any hotfixes and patches, to the latest versions.
• Security content — Updates security content only. (Default)
• Hotfixes and patches — Updates hotfixes and patches only.