Frequently Asked Questions (FAQ)
General
No. Malware Protection (Next-Gen Antivirus and Anti-Ransomware) is always a separate add-on license. It is not bundled with any Endpoint Central edition. You must purchase it separately. The Malware Protection add-on includes Anti-Ransomware. Purchase the add-on to get both NGAV and Anti-Ransomware. Endpoint Central's Free edition includes Malware Protection for up to 25 devices at no additional cost. For a full feature comparison and edition matrix: See Edition Comparison Matrix.
To check your license status, click the Profile icon at the top right of the console. Select License and check the Malware Protection add-on entitlement. You can view the Managed Computers count under 'Malware Protection - Add on'. If the count is 0, the add-on has not been purchased.
If not licensed, you can purchase the Malware Protection add-on by contacting support. Once purchased, the add-on will be enabled during the next agent refresh cycle (90 minutes).
The Free and Enterprise editions have the same features. Only the managed-endpoint capacity differs. The Free edition lets you manage only 25 endpoints at no additional cost. The Enterprise edition supports unlimited endpoint management.
This is a UI loading error. Follow these steps to resolve it:
- Open the web console in Incognito mode or another browser. Check whether the issue persists.
- Clear the browser cache and cookies.
- If the console still fails to load, check whether other administrators have the same issue.
- You can also try reinstalling Chrome.
Specifications & Settings
They currently support these Windows OS versions: Windows 11, Windows 10, Windows 8.1, Windows 8, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 Datacenter Azure Edition, Windows Server 2025 Datacenter Edition (arm64), Windows Server 2025 Datacenter Edition, Windows Server 2025 Essentials Edition, and Windows Server 2025 Standard Edition.
Anti-Ransomware currently supports only the Windows operating system.
The Malware Protection policies sync at the agent's next refresh cycle (default: 90 minutes).
Malware Protection provides native offline protection. It continuously monitors devices even when they are not connected to the network. Malware Protection does not depend on the cloud. Unlike traditional antivirus solutions, it does not require regular signature file updates. Refer here for more information.
Malware Protection runs alongside other AV/EDR products without functional conflicts. Examples include CrowdStrike, Microsoft Defender, and SentinelOne. However, consider the following:
Performance considerations:
- Dual scanning may increase CPU/memory usage during peak scan periods.
- Configure exclusion lists to avoid redundant detections between products.
- Consider disabling behavioral detection in one product if both have similar capabilities.
Malware Protection definitions are updated weekly for behavior rules and monthly for the ML malware engine model.
Yes. Endpoint Central supports Audit Only mode for all detection engines (Ransomware, Exfiltration, DeepAV, and Behavior Detection). In this mode, threats are detected and alerts are sent to administrators and endpoints. No automatic actions, such as process termination, quarantine, or cleanup, are performed. Use this mode to test policies and analyze detection patterns before you enforce blocking actions. See EDR Policy Deployment for configuration details.
No. USB and removable media scanning is disabled by default. To enable it, go to the module -> Settings -> Scan Settings and select Enabled against USB Scan and Eject USB on Malware Detection. Save the setting. The changes apply at the next agent refresh cycle (~90 minutes).
No, Endpoint Central currently does not offer a web-console "Scan Now" button for on-demand scans. Alternative scan options include:
- Scheduled scans: Navigate to the module -> Settings -> Scan Settings and enable Scheduled Scan Policy. Set the schedule and save the setting.
- Endpoint-local scan: End users can trigger a scan. To trigger a scan a folder, navigate to the folder in Windows File Explorer and right-click on it. Select ManageEngine Security → Scan with ManageEngine' and the scan will be initiated.
Endpoint Central's DeepAV engine is trained on malware samples from VirusTotal and public repositories. ManageEngine processes these samples and trains the engine in its controlled environment. The engine also uses proprietary threat intelligence and behavioral analysis. Threat definitions are updated weekly for behavior rules and monthly for the ML malware model to ensure detection of the latest threats.
Policy Deployment and Priority
The policy placed higher in the Priority Order takes precedence. When policies assigned to the same target have conflicting settings, Endpoint Central resolves the conflict based on this priority hierarchy.
Yes. The updated settings apply to all endpoints unless a higher-priority policy overrides those settings on an endpoint.
No. The default policy cannot be deleted.
The policy takes effect roughly 90 minutes after deployment. Until the policy syncs, the endpoint uses its previous policy settings.
The system automatically uses the next-highest policy in the Priority Order to determine which settings apply to the endpoints.
Next-Gen Antivirus
To generate the first detection in NGAV, follow the steps on this page. Also, go to the Settings tab and locate the "Notification Settings". Enable the "User Device Alert Notification" option in this section to receive real-time security event notifications on endpoints.
Anti-Ransomware
Follow the steps on this page to run the Ransomware Simulator.
Decoy files protect endpoints against ransomware and add a layer of protection. All managed endpoints contain a set of decoy files that serve as bait. Suspicious activity, such as decoy file encryption, triggers an immediate alert for a possible ransomware attack. Based on studies of ransomware attacks, we placed these files in selected folders across all managed endpoints. If the decoy files are encrypted, the administrator receives timely alerts to respond and mitigate the attack promptly. The bait files' names are "database.docx", "ME.txt", and "screenshoot.jpg".
Decoy/Bait file based detection is one of the several detection methods used by Anti-Ransomware. The core detection engine uses behavior-based ransomware motive detection and four patented layers that improve accuracy. For more information, see this page.
File-less attacks are difficult to detect because they leave little or no trace on the system. Anti-Ransomware's patented ML-assisted behavior detection technique can detect these attacks on the network.
No. Anti-Ransomware does not scan systems periodically. It analyzes and monitors systems in real time to detect and report ransomware attacks as quickly as possible.
Anti-Ransomware consumes no network bandwidth. Unlike other cloud-based EDR and Anti-Virus solutions, it does not need to fetch signature database files frequently. This reduces network traffic.
Anti-Ransomware uses anti-hook and anti-kill methods to prevent users from killing the agent.
The administrator can stop the agent from the server console by disabling Malware Protection. The Anti-Ransomware agent alone cannot be stopped. Disabling Malware Protection will stop both Anti-Ransomware and Next-Gen Antivirus protection. Refer to Add-on Configurations for more details on how to disable Malware Protection.
After Malware Protection is disabled, the deployed policies are marked for removal at the next agent refresh cycle. The managed endpoints will no longer be protected.
Microsoft's Volume Shadow Copy Service (VSS) creates shadow copies of the data stored on your device every three hours. The recovered file comes from the most recent backup cycle and can be 3 hours old.
Backup files are stored on the endpoint's hard disk. Patented tamper-proof technology protects these files.
By default, 10% of the disk space is used by the Windows VSS Service for backup functions.
When Shadow Storage reaches its capacity, it deletes the oldest shadow copy to make room for the new one and optimize storage usage.
No major conflicts are expected. It is designed to coexist with other VSS-based applications, including backup solutions. The only enforced restriction is that other applications cannot reduce the VSS storage allocation below 10% on protected volumes.
You can restore files encrypted by ransomware if a backup is available, even if the incident did not trigger an alert.
False Positives and Exclusions
All false positives are added as exclusions. These exclusions apply globally to all endpoints managed under Malware Protection. Learn More
Exclusion rules sync to the endpoint at the next agent refresh cycle (default: ~90 minutes).
If this error appears when marking an incident as a false positive:
- Verify that the exclusion matches the detected executable. Record its hash, path, and settings.
- If it doesn't match, delete the matching exclusion and re-create it with the same settings.
- Try marking the alert as False Positive again. If the error persists, collect agent logs and contact support.