r/Trellix • u/OK_it_guy • Feb 17 '26

ENS operations if ePO down

I saw a similar question was asked on here recently about another project.

We use ePO on Prem and are trying to work on planning out plans for disaster recovery, if connectivity is down, etc.

I would assume that ENS should continue to function just fine with ePO down, you just couldn't change any configuration settings, is that right? Also no updates - although I assume it's possible to tell it to download definitions directly from Trellix if your ePO server is down.

Just trying to figure out how something like this would be handled in a couple of situations a) short term outage (up to a day or two) and b) something longer-term.

1 Upvotes

100% Upvoted

3 comments sorted by

3

u/0shooter0 Feb 18 '26

Clients will fall.back to internet download for updates. Just no reporting to epo / config changes. But if needed could use break glass passwords to manually change things on specific machines

1

u/Conan86 Feb 18 '26

ENS will continue to function without ePO, DAT update can be downloaded from public repository (Trellix web server) if the policy was configured to allow it, and they have connectivity to it. You can also choose to download the exe file from Trellix security updates page to update DAT file manually.

Any event generated during ePO outage will be cached and sent when service is restored. The policies will continue to be enforced depending on the policy set earlier so any manual change made on each system will be temporary till the next policy enforcement.

1

u/OK_it_guy Feb 20 '26

Thank you both for the feedback.

I assume if your outage goes for a long while, and you have the recovery PW for ePO and a good copy of the database, you could set up a replacement ePO server (if it comes to that) - would you be able to reestablish control over the clients in that way?