Location of Ovr.db file:
Older Windows OS: C:\Documents and Settings\All Users\Application Data\WRData\
Newer Windows OS: C:\ProgramData\WRData\
Today is 1/14/2019, so my endpoints should have Ovr.db files dated 1/13/2019 or 1/14/2019. One day behind wouldn't be unusual if they hadn't checked in yet today, maybe longer if the endpoints had been off. However, the endpoints I've checked, have all been on either of those days. Here's some examples from today:
Windows XP SP3 - 1/9/2019
Windows Server 2003 - 11/22/2016
Windows 7 SP1 - 1/9/2019
Windows Server 2012 R2 - 1/9/2019
Windows 10 1803 - 1/9/2019
Based on the dates listed above you'd think the Ovr.db file should be dated 1/9/2019 since most of my endpoints have that date for the file. However, I have other endpoints going back to Windows XP SP3 with Ovr.db files dated today, 1/14/2019.
Basically this means that most of my endpoints are at least 5 days behind. Other endpoints are even further behind, going back more than 2 years. Until a week or two ago at least one of my Windows 7 SP1 endpoints was over a month behind on updating the Ovr.db file.
If anyone else has seen this issue on their SecureAnywhere Endpoint Protection endpoints I'd be interested to hear how you solved the issue. If you didn't solve the issue, still post that it's an issue so Webroot is aware that others are seeing the same problem. Thanks to anyone who can offer any help on the issue.
Best answer by NicCrockett
Thanks @freydrew! I got a message from them and sent them logs from one of the Windows Server 2012 R2 endpoints.View original