Endpoint Protection

Hello,

In policy exception,We have enabled trusted web domain execption,DNS or hostfile chnage exception..

Does this setting potentially allow a user, or malware, to make changes to local hosts file, add URL exceptions, etc...?

No, it does not edit host file

You will get an alert if the HOSTS file is edited or if your DNS settings are changed. You can start to see a lot of DNS alerts if you use VPN.

And yes they will be able to add web domains, DNS, and HOSTS file changes as exceptions.

Unless your confident in your users, I wouldn't allow users to chanmge these and only manage from the SEPM side.