How to block UltraSurf using Application and Device Control
| Article:TECH184200 | | | Created: 2012-03-19 | | | Updated: 2013-03-04 | | | Article URL http://www.symantec.com/docs/TECH184200 |
Problem
End users on the corporate network are using a proxy software tool called UltraSurf to bypass the corporate firewall or web filtering product, bypassing the restrictions of the company's content policy. How can this be blocked with the Application and Device Control (ADC) component of Symantec Endpoint Protection (SEP)?
Error
Cause
End users are using UltraSurf to change the Internet Explorer proxy setting.
Solution
To prevent the use of UltraSurf in your network, follow these steps on the Symantec Endpoint Protection Manager (SEPM):
- Create the Policy in Application and Device Control
- Create the rule
- Name. ex.: "Block UltraSurf"
- Name. ex.: "Block UltraSurf"
- Create the condition "Registry Access Attempts"
- In the "Apply this rule to the following processes"
- add
- in the box "Registry Key"
- Put the Key:
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings”
- Put the Key:
- In the Box "ProxyServer"
- Then OK
- Click in the Action tab:
- In Read Attempt
- Select "Block Access"
- In Create, Delete or Write Attempt
- Select "Block Access"
- Then OK
- In TEST/PRODUCTION
- Put Production
- Put Production
- OK
The policy attached below may also be imported into a SEPM and assigned to the client groups for which UltraSurf should be disallowed.
Article URL http://www.symantec.com/docs/TECH184200
Terms of use for this information are found in Legal Notices
Thank you.