topic Re: Change "Enable Always-Connect" always grey in Endpoint

Change "Enable Always-Connect" always grey

Paulo_Balau — Wed, 19 Aug 2020 10:03:36 GMT

Hi!

I have E82.40.

When trying to disable the "Enable Always-Connect" for users that are mostly at office I can't because it is always greyed.

Previously, I was able to change it.

Welll... It required to perform a connection first in order to the checkbox to appear selectable but now is always grey.

By default the "Enable Always-Connect" is checked and I need to uncheck. 🙂

How may I change it?

Best Regards,

Paulo Balau

Re: Change "Enable Always-Connect" always grey

G_W_Albrecht — Wed, 19 Aug 2020 12:59:57 GMT

Try sk108982: How to disable the default 'Always-Connect' on Endpoint Security / VPN Clients before deployment

Re: Change "Enable Always-Connect" always grey

Paulo_Balau — Thu, 20 Aug 2020 10:25:04 GMT

Seems is very usefull for future deployments, indeed.

For the already installed/deployed how may I change it?

Best Regards,

Balau

Re: Change "Enable Always-Connect" always grey

PhoneBoy — Fri, 21 Aug 2020 14:51:13 GMT

It's controlled via a Global Properties setting.
Change as appropriate and push Access Policy.
The existing clients should be updated once they connect again.

Re: Change "Enable Always-Connect" always grey

Maricec — Sat, 22 Aug 2020 17:42:49 GMT

Hello, I have the same problem, but I can't find Global Properties. This is my screen. Is there any other option to disable the "Always Connect" check?

Re: Change "Enable Always-Connect" always grey

PhoneBoy — Sun, 23 Aug 2020 03:23:44 GMT

As an end user, if your admin does not allow you to configure this setting, you can not disable it.

Re: Change "Enable Always-Connect" always grey

Maricec — Sun, 23 Aug 2020 13:26:49 GMT

Thanks for the quick reply. The only problem is that Check Point is installed in my personal computer. Is there any other way to prevent the software starts when I turn on my computer? I tried to uncheck it using Msconfig, but when I apply the changes, the check does not disappear

Re: Change "Enable Always-Connect" always grey

PhoneBoy — Sun, 23 Aug 2020 15:31:31 GMT

This not allowing the client to be disabled behavior is likely part of our self-protection mechanisms.
Short of getting your admin to disable this option or to change to allow it to be configured on the client, your only option is to uninstall the client.

Re: Change "Enable Always-Connect" always grey

Paulo_Balau — Mon, 24 Aug 2020 09:34:09 GMT

Hi! I have it as you mentioned from start. But, even on recently updated Endpoint Security clients (as mine) continue to show the option on grey.

It seeams they do not care of this global option 😞

Any other way?

Re: Change "Enable Always-Connect" always grey

Paulo_Balau — Mon, 24 Aug 2020 09:37:30 GMT

This Global Properties are not on the client itself but on the SmartConsole (were you define fw policies, etc, etc.)

One may say it could be useful to be on the SmarEndpoit console but it is not as well 😞

Re: Change "Enable Always-Connect" always grey

Paulo_Balau — Mon, 24 Aug 2020 09:38:19 GMT

Hello PhoneBoy...

I have it that way but is does not work as well. 🙂

Re: Change "Enable Always-Connect" always grey

G_W_Albrecht — Mon, 24 Aug 2020 10:24:58 GMT

Edit the clients trac.defaults file in a text editor, see sk108982.

Re: Change "Enable Always-Connect" always grey

NetMonkey — Mon, 24 Aug 2020 21:03:33 GMT

The only problem with this approach (and of course it is the prescribed approach) is the unfriendly nature of it. I have often wondered why, when using the full endpoint management server, that there isn't a better way.

In an enterprise estate, there are several user classes (sales, technical, accounts, executives), and these may require different VPN configurations. There is not a simple way to create a VPN policy for these user communities from the central management point, and that seems very strange. One size fits all does not work in large estates.

For example, in our own business - I want my sales team to have an always-on configuration. They need to connect if they are out of the office, so I want to give them a sales VPN profile (ideally with transparent machine authentication because they are sales people). But our technical teams need to log on to a completely different VPN gateway, but they are technical and they know when they need a VPN and when they don't. They have access to customer systems from the VPN, so 2-factor authentication is preferable.

These user groups have config needs that are completely different and whilst I can manage a user base with 2 or 3 different trac.defaults configurations across around 40 machines, it's clunky and for no good reason. @PhoneBoy it's time for EndPoint to grow up a little more and remember that unlike gateways, endpoints are managed by the desktop team where clunky fixes to text files that are not accessible via the management interface are a blocker to acceptability and ultimately to sales success. Engineers may love to hate the "just edit this file in vi" type of SK, but frankly it's a killer for most endpoint administrators and needs to evolve. Can it be in R81 endpoint management please ? 😄

Re: Change "Enable Always-Connect" always grey

PhoneBoy — Tue, 25 Aug 2020 02:10:40 GMT

R81 is in Public EA now, so if that feature isn’t there already, it won’t be in R81.
Agree that editing manual files on a specific gateway is a less than optimal solution.

Re: Change "Enable Always-Connect" always grey

AndrejN — Wed, 21 Apr 2021 07:20:10 GMT

I edited trac.defaults with notepad.

Find line "neo_always_connected STRING true GW_USER 1" and change it from true to false and save file. It works for me.

Re: Change "Enable Always-Connect" always grey

JeffCote — Wed, 07 Jul 2021 21:07:45 GMT

Is this setting available on the Harmony platform ?

Re: Change "Enable Always-Connect" always grey

PhoneBoy — Thu, 08 Jul 2021 05:01:12 GMT

The reason this is not configured in Endpoint Management is because there are gateway-specific dependencies required to implement this feature.
As such, enabling in Endpoint Management without that configuration wouldn't be terribly useful.

Re: Change "Enable Always-Connect" always grey

misterTi — Wed, 05 Jul 2023 11:18:34 GMT

The only simple solution, thanks.