Disable desktop messaging RDS Server

Hello Peter Geukens1,

guess this is what is meant under Known issues in Sophos Central Windows Server Protection – Remote Desktop (Terminal) Services.

Christian

Probably, but the article states:

 The use of Desktop Messaging can be disabled in policy except for the following:

• Malicious downloads, CryptoGuard and Data Loss Prevention.

I'm not sure in with policy I have to disable this.

The message is generated under the category "Web Threats"

Hello Peter Geukens1,

sorry, I'm afraid I'm not familiar with Central and the details of policies and events and their categories. And I have no RDS server where I could test - I've found out that an almost identical (and likewise unclear) article exists for SEC.
Web threat is in the Web Control section under Event Types. The Web Control Policy page says Web control does not support Desktop Messaging. and Desktop Messaging doesn't exist in the Server Web Control Policy. Murky. Hm, do the User Details show which policies are actually in effect (user and device/server) for a logged-on user?

I hope my replies don't hold more knowledgeable Community members off from reading this thread.

Christian

Hi PG1,

Can you send me screens/more details of the threat that was blocked and the desktop message? 

I think this does fall into the 'Malicious downloads' known issue, but I want to be sure. 

Web Control doesn't have Desktop Messaging as Christian states; this would be blocking access to sites based on their category and present to the user on screen.

Stephen

Hi Stephen,

As requested, a screenshot of the message.

Peter

Thanks Peter.

I believe this is the Malicious downloads. The safest way to confirm this is as follows:

Visit www.sophostest.com and try and access the 'Adult or Sexually Explicit' category. This should be blocked for the logged on user via a screen message but not trigger a notification pop up

Next scroll down and try the malware category, this will trigger a detection, trigger a notification and add an entry into the Web Threats events. 

Stephen

Thanks Stephen.

The malware category has triggered the same notification, so it is a malicious download.

I've bookmarked the test website :) 

Thanks for the support!

Peter