Ok, then it has not been redistributed from the server to the client yet. The faster way (I don't know if it is an official one but anyway... ) is to edit the "ar.conf" by yourself and add it manually.
What do you have now in your ar.conf? P. I don't see the "win_nullroute600" command. > > > Am I missing something? I did follow the instruction here: > > http://www.ossec.net/main/manual/manual-active-response-on-windows > > > > Please advise. > > > > Thanks, > > > > SW > > >
