Managing Computers

You can view logs of computers based on it's IP address.

To view computer logs by it's IP address:

1. Go to Asset Management > Computers.

2. Select the applicable computer or user from the list.

3. From the top toolbar, click .

4. Select General Actions > View Computer Logs.

   The system opens the Logs menu and shows the computer logs.

You can create a virtual group. See Managing-Virtual-Groups.htm.

You can add computers to a new virtual group. See Managing-Virtual-Groups.htm.

You can add a computer to a virtual group. See Managing-Virtual-Groups.htm.

When the Endpoint client is installed on a computer, information about the computer is sent to and stored on the Endpoint Security Management Server A Security Management Server that manages your Endpoint Security environment. Includes the Endpoint Security policy management and databases. It communicates with endpoint clients to update their components, policies, and protection data..

Resetting a computer means deleting all information about it from the server.

Resetting a computer does not remove the object from the Active Directory tree or change its position in the tree.

Computer reset:

• Removes all licenses from the computer.

• Deletes Full Disk Encryption A component on Endpoint Security Windows clients. This component combines Pre-boot protection, boot authentication, and strong encryption to make sure that only authorized users are given access to information stored on desktops and laptops. Acronym: FDE. Recovery data.

• Deletes the settings of users that can log on to it.

• Removes the computer from Endpoint Security Monitoring.

• Deletes the Pre-boot Authentication before the Operating System loads. settings.

• Marks the computer as unregistered.

After you reset a computer, you must reformat it before it can connect again to the Endpoint Security service.

You may decide to reset a computer if:

• The Endpoint client was uninstalled or the computer is re-imaged.

• It is necessary to reset the computer's configuration before a new Endpoint client is installed. For example, if the computer is transferred to a different person.

Removes the asset from the Local or Active Directory and adds it to Deleted Entities in the Organizational Tree. This operation discards the assets license information. You can use this operation when you remove an asset from your domain.

Note - If the Endpoint Security client is still installed on the asset, the client continues to receive the updates from the Endpoint Security Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..

To add the asset back to the Active Directory, see Recover.

Adds the deleted asset back to the Local or Active Directory from Deleted Entities in the Organizational Tree. The asset's status is not Active until its Endpoint Security client connects and synchronizes with the Endpoint Security Management Server. You can use this operation when you add an asset back to the domain.

Note - You can recover only a deleted asset.

Warning - Removes the asset from the Harmony Endpoint management permanently. You cannot recover a terminated asset. We recommend to terminate an asset only if it is discarded or disposed or the Endpoint Security client is uninstalled.

Harmony Endpoint can scan and import users, groups, Organizational units (OUs) and computers from multiple supported directory domains. See Managing Active Directory Scanners.

Runs diagnostics on an endpoint to collect this information:

• Total CPU and RAM usage in the last 12 hours.

• CPU usage by processes initiated in the last 12 hours. For example, the CPU used by Anti-Malware to scan files.

  You can review the CPU usage data to identify processes (scans) that consume CPU more than the specified threshold and exclude such processes from future scans.

  Note - This is supported with Endpoint Security client version E86.80 and higher.

  Warning - Only exclude a process if you are sure that the file is not malicious and is not vulnerable to cyber-attacks.

  To view the latest diagnostics report, see Show Last Diagnostics Report.

To see the diagnostics report:

1. Go to Push Operations menu.

2. Select the row of the Run Diagnostics push operation you performed.

3. In the Endpoint List table, under Operation Output column, click View Report.

By default, the report shows the data for Total Usage.

• To view the report per capability, in the left pane, under Process, click the capability.

• In the CPU widget:

  • To change the CPU usage threshold, in the Threshold list, set a value (in percentage). The default value is 10 percent.

  • To set the selected threshold as default, click Set Default.

  Note - After changing the threshold, Harmony EndpointAdministrator Portal re-evaluates to suggest processes that exceeded the new threshold.

To add a suggested exclusion to the exclusion list:

1. In the Suggested Exclusions area, clear the checkboxes if you do not want to exclude the processes from future scans. By default, all the processes are selected for exclusion.

2. Click View Selected Exclusions.

3. To add the exclusions to all the rules, select Global Exclusions.

   1. Click Create & Review.

   2. Click Save.

   3. From the top, click Install Policy.

4. To add the exclusions to a specific rule, select Device Exclusions Per Rule.

   1. Click Create & Review for the rule.

   2. Click OK.

   3. Click Save.

   4. From the top, click Install policy.

Shows the latest diagnostics report. By default, Harmony Endpoint runs the diagnostics every four hours.

For more information about the diagnostics report, see Run Diagnostics in Performing Push Operations.

You can view, create, lock and unlock authorized Pre-boot users. See Authentication-before-OS-Loads-Pre-boot.htm.

If the operating system does not start on a client computer due to system failure, you can recover your data from the computer:

• Check Point Full Disk Encryption Recovery

• BitLocker Recovery

• FileVault Recovery

You can recover removable media passwords remotely, using a challenge/response procedure. See Media Encryption Remote Help.

You can give access to users who are locked out of their Full Disk Encryption protected computers. See Giving Remote Help to Full Disk Encryption Users.