Endpoint Protection

There is a policy setup on a container that is called Disable AV.  This container has the inherit option unchecked and the Disable AV policy applied.  I added a server to this container and clicked on update policies from the client yet it remains enabled.  I tried multiple servers and nothing.  In addition I cannot stop the SepMasterService as all options are greyed out.  I unchecked the box that stops anyone from the client end from modifying the service or app.

Any idea on why this will not take affect?

I don't believe you will be able to stop the service itself.

You can only disable AV thru the GUI.

Did you verify the client picked up the new policy? Policy numbers match on client/SEPM?

I just verified that the policy numebrs do match.

Also something to note, I just made a new group and tried to add the disable av policy in it and it tells me "All types of policies for this location already exist.  There are no more policies to add".

So when you open the GUI and under Virus and Spyware Protection >> Options is Disable all Virus and Spyware protection features greyed out still?

You need to replace the current policy with the disable policy

Sorry for the multiple post but I am discovering new things.

I went into policies and I do not even see the policy for disabling AV.  Where is that option located at when making a new policy to disable it?

It has never been greyed out but it will not work.  When I click on it the system tray icon goes away and comes back about 3 seconds later still showing active.

To further clarify it looks like the last admin made a policy for it and that policy does not work and isn't located under the policy list anymore so I am pretty sure if I remove it from that group that the policy will not be able to be added back which is why I need to figure out where the option is to set the av to disabled when making a new policy.

Hi,

Thank you for posting in Symantec community.

You cannot stop the SepMasterService, you can only restart the SEP client service.

To restart go to Start--> Run --> smc -stop & smc -start (It will restart the SEP client service.)

As per comment last policy is not working, can you repair the SEPM?

Chec this article as well:

How to prevent SEP features from being disabled in the client GUI in SEP 12.1

http://www.symantec.com/docs/TECH168990 

The stop service command gets denied.

Doing the reverse of that doc disabled it for me.  Thank you very much.  I will also use that to lock down the rest.

Hi,

Thanks for the update.

Glad to know it's working as you want. 

Same article is present at forum as well, here it go:

How to disable SEP features at client GUI in SEP

https://www-secure.symantec.com/connect/articles/how-disable-sep-features-client-gui-sep-121

Please don't forget to mark your thread as 'SOLVED' with the answer that best helps you.