Endpoint Protection

My Sep 11 client has been updated with "Proactive Network Protetion" which caused high utilization.  The client is managed by a Sep management server I want to know when the Client decided to add this function.

Is there a log on the local client that shows when the client adds a new service like "Proactive Netowk Protection" on the local client?

Thanks,

Andy

HI,

You can found PTP logs

SEP client > View Logs > PTP Logs > System Logs

I just checked that log and it only goes back 2 weeks and doesn't show any config changes just TruScan failures "Whitelist Failure".  I see a new Sylink file back in March but don't think that can change the modules loaded by the sep 11 client.

HI,

If you have apply any policy in SEPM console you can check Policy no in Client site.

Checking the policy serial number on a client

http://www.symantec.com/business/support/index?page=content&id=HOWTO55604

You can compare SEPM group and Client side policy no.

Check if you have scheduled autoupgrade to any group with all feature.

This had to have been done manually. If a component is not available, it won't just show up. You can check the system log but perhaps someone assigned a package using the autoupgrade feature or someone installed an incorrect package?

+1 for Brian.

This had to have been manually.  If the autoupgrade has been added or if, by chance, the package changed.  For example changing SEP(M) version and adding a new package for deployment, with out indicating to keep existing features, the system might have decided to add all components for you.

Thanks for the responces,  I think if there were a way to see when components have been changed from the client side I could work my way back to policy changes on the console. 

A policy change could have occurred and the been removed and I'd hope you'd see this in the client!?

Andy