Installing Policy Changes on Clients

When you save the Policy, Endpoint Security does not automatically deploy it. This behavior lets you save changes to the Policy without affecting users. It also lets you deploy the Policy at the most convenient time, for example, at night.

To install the Policy on Endpoint Security clients:

• In the Policy tab, click Install.

  or

• From the File menu, select Install Policies.

The policy becomes available for endpoints to download on the next heartbeat or the next time users log in.

If you make changes to an object that is related to Virtual Groups, the changes are enforced immediately. For example, if you move an object into a virtual group, the rules for that group apply to the object immediately. However, if you change a policy that is assigned to a virtual group, the changes to the policy only apply after you install policies.

The Heartbeat Interval

Endpoint clients send "heartbeat" messages to the Endpoint Security Management Server to check the connectivity status and report updates. The time between heartbeat messages is known as the heartbeat interval.

Note - The default heartbeat interval is 60 seconds. A shorter heartbeat interval can cause additional load on the management. A longer heartbeat interval may lead to less up-to-date logs and reports.

The endpoint computer Compliance state is updated at each heartbeat. The heartbeat interval also controls the time that an endpoint client is in the About to be restricted state before it is restricted.

It is possible to create restricted policies that will automatically be enforced once the endpoint client enters a restricted state

To configure the heartbeat interval and out-of-compliance settings:

1. Click Manage > Endpoint Connection Settings.

   The Connection Settings Properties window opens.

2. In the Connection Settings section, set the Interval between client heartbeats.
3. In the Out-Of-Compliance section, configure when a client is restricted. Configure the number of heartbeats in Client will restrict non compliant endpoint after. The default is 5 heartbeats.
4. Click OK.

Configuring the "About to be Restricted" State.

The About to be restricted state sends users one last warning and gives an opportunity to immediately correct compliance issues before an endpoint computer is restricted. You can configure the period of time that a user has to correct the issues after the warning message shows.

You define this period of time in heartbeats.

To configure the time period that users have before an endpoint computer is restricted:

1. Click Manage > Endpoint Connection Settings.

   The Connection Settings Properties window opens.

2. In the Out of Compliance section, enter the number of heartbeats.
3. Click OK.

When you configure this time period, we recommend that you give users sufficient opportunity to:

• Save their data.
• Correct the compliance issues.
• Make sure that the endpoint computer is compliant.

The formula for converting the specified time period to minutes is:
<number of heartbeats > * <heartbeat interval (in seconds)> * 60.