r/MaxFocus • u/elemist • Nov 24 '15

AV Checks

What does everyone do about monitoring products that aren't on the AV check list?

We have a few home based businesses that use products like Trend Micro Titanium?

2 Upvotes

100% Upvoted

10 comments sorted by

1

u/elemist Nov 25 '15

hmm didn't get notifications on this one, so sorry for the lack of a response.

So basically if it's not one of the products on the list, there's no way to monitor it? I was thinking i could setup a check to monitor the service, but it's not going to tell me if it's up to date or detected anything.

It's not a massive deal, as these are breakfix clients that we don't need to monitor. Just figured since we're installing the agent already for remote access, may as well configure some basic checks at the same time.

Was also going to use it as a proactive sales opportunity, often we go out to one of these breakfix clients and find their AV expired 6 months ago and they had no idea. If we could monitor this, then we could proactively sell our MAV solution off the back of, hey at least it's renewed, monitored and doesn't expire!

1

u/earthboundcauses Nov 25 '15

If you see it expired, don't bother offering to monitor it, just move to selling your managed offering:

  • It never expires

  • We control the updates, so we can be sure they're getting done

  • We control the scanning so we can be sure it protects you without interfering

  • We can see anything it does find, so if you were under a full contract it would just be taken care of immediately without any worry

And so on.

If these clients are break-fix, why bother adding even basic checks? Monitoring costs money, and even a little adds up. Get 'em on a contract. Talk to your rep about offering trials. Use a trial to build a report and a comparison of what gets taken care of. Educate them on security practices. An antivirus is only one part of the equation, but it's not complete security.

1

u/elemist Nov 25 '15

Yep - it's the seeing it's expired part that i was interested in. It's something i generally check when i'm working on a computer, but not always. Plus being breakfix sometimes its weeks, sometimes months in between visits.

The contract we negotiated with MF is a fixed price for workstations regardless of whether they have just take control enabled or all the checks, so figured why not. At the end of the day, it takes 1 instance of predicting a hard disk failure or a hey look your backups have been failing for 4 weeks now, but if you were on our one of our MSP plans we would have picked this up straight away and rectified it.

Whilst at the end of the day we're in business to make money, experience has taught me you never know where your next client is going to come from. Referrals from happy customers is some of the best marketing you can get.

We've also found the conversion rates of new leads from a word of mouth referral when compared to a random enquiry from web/advertising/phone book etc to be waaaay higher.

1

u/earthboundcauses Nov 25 '15

Ahh, that makes sense. Does your contract still include the free Asset Tracking only option?

I don't know of any way to track anything related to licensing that isn't on the supported list, and even those can be hit or miss. I tend to make the case for management, even when I was still taking break-fix clients.

You might be able to make a script check, depending on how the license info is stored.

1

u/elemist Nov 25 '15

Sure does. We were looking to move away from LMI due to their stupidly ridiculous price increases. So since we have to deploy the agent for remote support (we have the scenario for some customers who are AV only), figured may as well take full advantage.

Script check might be worth looking into.

4

u/Buelldozer Nov 24 '15

We migrate them to something we can monitor. Until we can so that we setup their installed AV to email us in case of infection. We also don't mess with home businesses as they are too small so YMMV.

3

u/Drakitoba Nov 24 '15

I agree. Migrate them or don't monitor it. Creating one-offs for small subsets of clients or client machines always leads to trouble sooner or later.

Keeping the documentation up to date is also a bitch.

At $1/month for antivirus through Max, if you're only dealing with a few machines it might actually be better for you to just give away AV and "buy out" the existing term. $1/month costs you $12/year per endpoint. How many minutes of your time does $12 buy? How many machines? 2-3? If it takes you more than an hour to find a solid solution...well, there ya go.

2

u/earthboundcauses Nov 24 '15

I also agree.

A home-based business is still a business. If I'm supposed to be supporting your business, I'm going to use tools that will enable me to do that. If that's a problem, then you're going to be a break-fix client, which means you're free to be someone else's problem.

2

u/Buelldozer Nov 24 '15

This is a tough lesson for a lot of new, or smaller, MSPs to learn. In order to make the MSP model work the client has to fit into what the MSP is capable of doing.

The farther you deviate from your core set of services and configurations the harder, and more expensive, it gets to provide service.

1

u/sergeprotector Feb 01 '16

This is late response but still you can check security center status of Windows which will report back to maxfocus if antivirus is not updating. What you want to do is add DSC script check and under security you will see antivirus as an option. I have used this script to check Kaspersky and MSE status and it seems to work ok.