Video Screencast Help

Cannot Change IP Address when SEP was enabled

Created: 04 Mar 2013 | 5 comments
kintachi's picture

Hello,

Does SEP preventing the user to change DNS IP Address?

Comments 5 CommentsJump to latest comment

.Brian's picture

SEP 12.1 can block DNS changes

Symantec Endpoint Protection 12.1: Blocked System Change Events produce unexpected messages

Article:TECH161646  |  Created: 2011-06-06  |  Updated: 2011-06-28  |  Article URL http://www.symantec.com/docs/TECH161646

 

This can be configured in the SONAR settings in the SEPM. It is under the AV policy

You can set an exception:

Creating an exception for an application that makes a DNS or host file change

Article:HOWTO81119  |  Created: 2012-10-24  |  Updated: 2013-01-30  |  Article URL http://www.symantec.com/docs/HOWTO81119

 

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

kintachi's picture

Hi Brian,

Thank you for quick response. So you mean there is no way changing DNS IP when SEP is enabled??

.Brian's picture

If you have the option set to Block than it will be stopped. You can set it to ignore or add an exception.

You can set one of the following actions to take for DNS changes

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

pete_4u2002's picture

yes, if any malicious thing tries to change DNS the SEP will know it.

Chetan Savade's picture

Hi,

Could you please let us konw at which place you are trying to change DNS ip address?

 

Chetan Savade
Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<