Change Host Checker Messages

[gerryR_]

Hi

Currently setting up our SA2500, on setting up a lock down policy we are defining things like a minimum OS version, custom registry key entries however when the host checker fails at one of these checks the error pretty much tells you whats missing,

To me that negates the security checks as any would be intruder would just have to upgrade the OS or add the custom reg key (it tells you the missing key and value) to get one step closer to entering the system.

Can these erros be changed to more generic or custom messages?

Thaks for any help

gerryR

[dcvers_ · Accepted solution]

You need to do a couple of things to make messages anonymous.

1. Make sure the Policy Name does given away details of the check, e.g. Something like Check 1

2. Turn off the "Send reason strings" option

You can also enable Custom Instructions with some message telling the user how to get help. e.g. "Please make a not of the Check number that failed and call the helpdesk"

With these settings you should just see the name of policy and the custom instructions. Then all you need to do is make sure the helpdesk knows what to do to fix each failed check.

[gerryR_]

Thanks dcvers

[stine_]

If you run your host checker after authentication, you minimize your exposure to undesirable users. However, any user that is running IE under a debugger will know exactly what you're checking for.