Disable expert mode audit log/notification nagware/adware

[Paul_Hagyard]

With reference to sk181230 and the following FAQ lines:

7. Can I permanently disable the pop-up from being displayed?

Not for now. We encourage our customers to strengthen their security.

I should not need to be spammed every month (the longest it will let you pause the popups). We monitor our systems carefully, and we have no desire to use the Infinity Portal. In some environments there is no direct Internet connection.

Is there a section in the product license that says "You agree that we can nag you about things and you can't disable that nagging"?

This is nagware/adware - please get rid of it.

[PhoneBoy]

While I do remember seeing what you saw the first time I got into R81.20 after upgrading SmartConsole, this time, I was presented with the following:

And yes, you are asked to confirm after No, thank you is pressed and there's a "don't ask me again" checkbox.
However, even with this, I am still prompted every time I open SmartConsole.
Paging @Tal_Paz-Fridman
Recommend a TAC case: https://help.checkpoint.com 

[PNH]

Agree, customers pay millions for enterprise software and then have to get annoyed endlessly by such noise.

But since it has a setting to remind you again in a month, it has to store that somewhere, so

some kind of workaround maybe:

Open SmartConsole, ask the popup to remind you in 1 month and say no thanks to it, then close SmartConsole

Then in Smart Console config usually in c:\users\username\AppData\Roaming\Check Point\R81.??\SmartConsole\UserSettings\

look for file named "user.config" i subdirectories for relevant login user (and domain if you use multi domain)

It is an XML file.

In there increase the first digit by a few in the setting named:

expertModePopupRemindDate

(i guess this is windows time in milliseconds for when next time it should nag you)

But it does not seem totally consistent, so who knows..

[the_rock]

I wish there was a simple way to get rid of these pop-ups...

Kind regards,

Andy

[Paul_Hagyard]

Nice catch. It's the number of milliseconds since the epoch (1970-01-01 UTC) to when it will next ask.

My file contained "1701860400000"

Using date on the SC server with three zeros removed:

[Expert@host:0]# date --date='@1701860400'
Thu Dec 7 00:00:00 NZDT 2023
[Expert@host:0]#

One month from today, when it asked me.

Get a date in milliseconds that's 10 years away 🙂

[Expert@host:0]# date -d "now + 3650 days" +"%s%3N"
2014662651247
[Expert@host:0]#

I opened and closed SmartConsole a couple of times and the value seems to have stuck.

[Duane_Toler]

All mine were set to "-1" for that key value.   I made them all 2014662651247.  I tested one and I didn't get nagged! Thanks @Paul_Hagyard 

[Harald_Hansen]

Still intensely dissatisfying that we have to implement this hack on every computer with SmartConsole installed. I use many different instances of SmartConsole at various customers and cannot implement this everywhere. 

Check Point should be better than this, this is not WinRAR or other shareware/nagware.

[Paul_Hagyard]

I was thinking about writing a simple Powershell script to find and replace, but for now the following (from a cmd prompt) finds any user.config file under C:\Users containing the string expertModePopupRemindDate. You can copy/paste the resulting strings into notepad file/open.

C:\Users\someuser>findstr /m /s "expertModePopupRemindDate" "C:\Users\user.config"
C:\Users\someuser\AppData\Local\Check Point\R81.20\SmartConsole\UserSettings\<a SC user>\<a SC IP address>\SMC User\user.config
C:\Users\someuser\AppData\Local\Check Point\R81.20\SmartConsole\UserSettings\<another SC user>\<another SC server name>\SMC User\user.config

[the_rock]

Im totally with you on this one @Paul_Hagyard . I cant seem to get rid of it either in my R81.20 lab, though I am running latest smart console.

Andy

[Timothy_Hall]

There is another one of these that pops up in the R81.20 SmartConsole whenever you disable a Threat Prevention blade, trying to quiz you about why you disabled it and sending your response to Check Point.  Annoying.

[the_rock]

Omg...that one is sooo ANNOYING 🤣

[Harald_Hansen]

I concur.

These prompts belong in adware ridden mobile games, not in professional security software. Nagging will end up in the negative column when customers are renewing security solutions. 

There are many of these prompts I think Check Point (and others like Microsoft) should rethink. 

[Paul_Hagyard]

I've had multiple customers asking about this lately. My response is that the Check Point SK article says it cannot be disabled and they should raise a complaint with their Check Point account manager.

Can someone from Check Point address this? It's not a good look at all.

[Martin_Raska]

I am also annoyed by this pop-up. Please get rid of it in the next update of SmartConsole, because it's a totally missed intention, and the reputation of Check Point is going down.

[the_rock]

I agree 100%, should be easy to do this from smart console itself, rather than having to modify bunch of files.

Andy

[PhoneBoy · Accepted solution]

Editing the relevant user.config files to disable this should work (thanks @Paul_Hagyard )
That means:

• Finding all instances of expertModePopupRemindDate in user.config files on the SmartConsole PC. This can be easily done in Windows using the CLI command: findstr /m /s "expertModePopupRemindDate" "C:\Users\user.config"
• Changing the value for this option in each of these files to a date sufficiently in the future (like 2014662651247, which is ~10 years away).

As for a more permanent solution, this is being discussed on R&D at present. 

[S_E_]

---

@PhoneBoy wrote:

As for a more permanent solution, this is being discussed on R&D at present. 

---

Hi, are there any news from R&D how to get permanently rid of these messages?

We are still prompted every time opening SmartConsole. For every MDS domain...

Do you think an RFE would help? 

Regards

[Youssef_Obeidal]

Hi, last week, a fix was delivered to prevent this popup from being prompted every time SmartConsole opens.

now, it should say, "Remind me in one month" for the first time, and after a month, it should show "Don't show it again"

to verify you have the latest fix, run the following on your management server :

cpinfo -y CPUpdates | grep BUNDLE_WEBCONSOLE_AUTOUPDATE 

the fix included in take 97

[Harald_Hansen]

This is a decent start.

It is still not good enough for the complex/large customers, so please fix this by removing all nag screens (including Whats New) for Multi Domain Deployments and deployments with multiple high end devices. That should be an indication the environment is administered by experienced people and thus is an annoyance, not an advantage.

It could be solved by making all these nag screens optional in a global setting on the SmartCenter/MDS server.

Best regards,
Harald

[Martin_Raska]

I fully agree.

[S_E_]

hi

MDS-01# cpinfo -y all | grep CONSOLE

This is Check Point CPinfo Build 914000239 for GAIA
HOTFIX_WEBCONSOLE_AUTOUPDATE
BUNDLE_WEBCONSOLE_AUTOUPDATE Take: 97

Regards

[Henrik_Noerr1]

Hi, are there any news on how to get permanently rid of these messages?

[S_E_]

Hi, I'm afraid no.

We are still fighting with this issue. Told already multiple times to Lead Customer Success Manager. 

But with the latest SmartConsole Build 81.20 B654, there is an additional popup on top (..VPN...)

Regards

[Duane_Toler]

I wrote a short PowerShell script, posted to another forum post; I can't get the "Permalink" option to work for it, so here's the other thread:

https://community.checkpoint.com/t5/Management/How-to-get-permanently-rid-of-Introducing-Expert-audi...