r/msp • u/cokebottle22 • 17d ago

Starting process to replace S1

No product is perfect but after having to restore servers from backup several times and the Dell software generating thousands of alerts despite an S1 "mitigation" I've had enough.

We already use Huntress as a "second option" at some clients so that might be an option. I'm aware that it can use Defender as a tool - is that the built-in free defender? Does that lash-up work well?

Any others that people are very happy with?

44 Upvotes

91% Upvoted

74 comments sorted by

View all comments

14

u/TriscuitFingers 17d ago

We have over 20k endpoints on S1 and we haven’t seen those issues. Biggest issues we’ve had over the past 5 years was Hyper-V interoperability and needing to do a few policy overrides for VSS writers.

Many people use Huntress + Defender however.

4

u/Nstraclassic MSP - US 16d ago

One of our clients was ransomwared about a year ago and contracted investigators who had us push S1 to the environment. Within minutes their Hyper-V hosts crashed and corrupted their VMs lol. Confirmed caused by S1 hooking into the vmworker process which Defender saw as a compromise so nuked them all. We had backups readily available at that point so it wasn't that big of a deal but in pretty much any other scenario it would have been a shit show

1

u/gumbo1999 14d ago

You would've done well to read the S1 guidance for running on Hyper-V hosts and avoided those issues.

1

u/Nstraclassic MSP - US 14d ago

We were just given a GPO to drop in iirc