登录
 
主页技术资源库学习下载支持社区
IT 专业人士的资源 > 论坛主页 > Forefront Client Security - Security State Assessment > I need to exclude some checks reported by the Security State Assessment check.
提出问题提出问题
搜索论坛：
 

已答复I need to exclude some checks reported by the Security State Assessment check.

  • 2009年11月12日 11:34Jono2p 用户奖牌用户奖牌用户奖牌用户奖牌用户奖牌
     
    登录进行投票
    0
    登录进行投票
    I work in an organisation with approx 5000+ clients. We are in the process of migrating to Microsoft Forefront from McAfee. When I run the 'Security State Assessment Summary', there are a few checks which I would like to disregard. For example, each client machine has a built in Admin/special account logins which are set to never expire. These are bing flagged by the vulnerability report. Also, certain generic 'autologon' machines are being flagged that we have setup.

    Is there a way to exclude these and other checks from the SSA scan?
     

答案

  • 2009年11月16日 8:17Nick Gu - MSFTMSFT, 版主用户奖牌用户奖牌用户奖牌用户奖牌用户奖牌
     已答复
    登录进行投票
    0
    登录进行投票

    Hi,

     

    Thank you for the post.

     

    As far as I know, The parameters of SSA checks are not configurable. For example, you cannot change which services the Unnecessary Services check identifies as possible vulnerabilities. We currently not support custom SSA checks.

     

    Regards,

    Nick Gu - MSFT
     

全部回复

  • 2009年11月16日 8:17Nick Gu - MSFTMSFT, 版主用户奖牌用户奖牌用户奖牌用户奖牌用户奖牌
     已答复
    登录进行投票
    0
    登录进行投票

    Hi,

     

    Thank you for the post.

     

    As far as I know, The parameters of SSA checks are not configurable. For example, you cannot change which services the Unnecessary Services check identifies as possible vulnerabilities. We currently not support custom SSA checks.

     

    Regards,

    Nick Gu - MSFT
     
  • 2009年11月20日 12:30Jono2p 用户奖牌用户奖牌用户奖牌用户奖牌用户奖牌
     
    登录进行投票
    0
    登录进行投票

    Thanks for replying back Nick,

    I was led to believe that these checks will be configurable when thenext-gen version of Forefront (Stirling) is released.

    Is this true?

     
  • 2009年12月30日 17:24Kurt FaldeMSFT, 版主用户奖牌用户奖牌用户奖牌用户奖牌用户奖牌
     
    登录进行投票
    0
    登录进行投票
    As far as I  know yes.  You can get SSA in v1 to disregard some items if you have them configured via Group Policy to be that way.. for example if you have more then X amount of admins locally on a system I believe SSA alerts on that HOWEVER if you have a GPO applied to that machine that specifies via the Restricted Groups feature that various users are in the Administrators group then SSA will disregard the results of that check as it believes you must know what you are doing if you have this specified via GPO.  So if you can find the correlating setting for a certain check in GPO you may be able to set that in your GPO's to override the results of those scans.
    CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde