Endpoint Protection

The thing they are showing "Disabled" for is "Tamper protection" I have over 650 installations of SEP across the board which are ALL disabled by policy for Tamper protection. Why are there 50 displayed in the SEPM? This is making things a bit confusing. Since they are disabled by policy, they should not be in the disabled list on the SEPM homepage.

Were they upgraded from a previous version of 11.x or 12.1?

Yes. The Policy to turn tamper protection has ALWAYS been off since at least version 9 (SAV)

So in theory there *should* be nothing different with these compared to the other 600 or so machines with it off? Aside from maybe different policies, locations, etc. The normal stuff..

what is the SEPM version?

12.1.2015.2015

Yes, I do not know why they chose to be stand outs.

Makes me think it is cosmetic but than I would expect to see more showing up.

Out of curiosity, were these unmanaged at any point than converted to managed?

That very well could be the case, but I do not have a record of what was moved. I just replaced the Sylink if they were not managed.

Open a case with Symantec Support - seems to be defect in this version and similar to issue as when you disable the Firewall by policy (withdraw policy) - this should be reported as disabled by policy and not trigger any alarms on the Home Page in SEPM but it does and as a matter of fact since 12.1 RU2 release. Definitely something that needs to be looked at by Symantec Engineering teams.

I have found a few bugs with this version. If you look at my other case about not being able to install you will see what I mean.

Yes have seen that already as well, apparently some fixes and improvements were mentioned in other posts for next sep 12.1 RU2 MP1.

I have found a commonm bond, they are ALL 32 BIT machines. Mostly XP Mode and 2003 servers.

I have found a commonm bond, they are ALL 32 BIT machines. Mostly XP Mode and 2003 servers.

I have to make a revision to this post, back in a min...

They are ALL also 11.x machines. These are most likely the ones that were 32 clients transitioned over from the OLD SEP Server.

Perhaps something is still "stuck" on the client and it is sending incorrect info to the SEPM. Do you have the ability to do an uninstall/reinstall on one of the clients to test it?

I did it on a couple of the servers, now I just need to wait to see if they populate.

This version certainly has caused the most administrative overhead I have ever seen.

You may be able to check the registry on an affected client as well

For XP/2003 check:

HKLM\Software\symantec\symantec endpoint protection\AV\Storages\Symprotect\RealTimeScan

Look for the "Disabled" key, is it set to 0 or 1?

I believe this is the correct key.

After the upgrades they are no longer there.

This will be the solution because it does require upgrading, this is pertaining to my issue thoug. Once i upgraded they lead a normal tamper protection free existence.