After migrating to 12.1, change the Tamper Protection policy setting to "Block it and log the event". For information about changing this setting, see the Symantec Endpoint Protection and Symantec Network Access Control Implementation Guide or the in-product help.

You can also work on these steps:

1. Log on to the Symantec Endpoint Protection Manager console with an administrator account.
2. If you already have an Exceptions policy, proceed to step 3. Otherwise:
   1. Click Policies, then Exceptions.
   2. Click Add an Exceptions policy.
   3. Give the policy a suitable name, then click OK.
   4. Click Yes at the Assign Policy prompt.
   5. Place a checkmark next to the group(s) with your Citrix server(s).
   6. Click Assign finish assigning the policy.
3. Click Monitors, then click the Logs tab.
4. In Log Type, select Application and Device Control.
5. In Log Content, select Application Control.
6. Click Advanced Settings >>.
7. In Event Type, select Tamper Protection.
8. If necessary, change the Time range to a range that includes the last Tamper Protection event.
9. Click View Log, you will be shown a list of Tamper Protection Violations.
10. Select an appropriate violation and, at the top of the window, choose Add Process to Exception Policy, then click Start.
11. Confirm the file to be excluded is correct.
12. Click Policies, then Exceptions.
13. Select all the Exceptions policies you wish to add the exception to.
14. Click OK to complete the process.
15. If you receive a message from your browser about closing the window, click Yes.
16. Click Policies, then Centralized Exceptions.
17. Double-click the Centralized Exception policy you added the new exception to. The policy will open.
18. On the left-hand side, click Centralized Exceptions and confirm the file is listed and has an Action of Ignore.