Endpoint Protection

I have 2 environments, one is SEP12.1.4 and 12.1.7 I'm in the process of moving all machines to the new SEPM. I have a special group created that only machines in this group can have SEP disabled. However for some reason it turns itself back on after about 3 min. Its exactly the same policy and settings, I copied it over. Any idea what can be causing this issue and how to fix it?

By default Auto-protect will enable itself after 5 miniutes unless you specify otherwise. In the AV policy - Auto-Protect tab - Advanced tab under Auto-Protect Reloading and Enablement. Adjust it here or uncheck it.

NTP will also re-enable itself after 5 minutes - by default.

I changed the time to 60 min updated the policy and it still reverts after 5 min.

Specifically, which component?

Also, does the client policy serial number match the SEPMs policy serial number?

I chnaged the time from 5 to 60 and when that didnt work I unchecked enable afer: The change was made in SV policy in Auto-Protect in Advance tab. Policy SN are the same

Is this affecting all of your clients in that group? Perhaps there may be policy corruption present.

Thats what I am thinking. Testing this now

To clear it up, you usually just need to create a new group and move clients into it so they change policy. Once that happens, move themback again and let them grab the policy. Then you can test the disabling again.
 

I created a new group and a new AV policy, updated the client with new policy and it still enables itself after 5 min. I have it set to 60. Any idea? this is a new installation with new clients installed.

Is it re-connecting to the prior SEPM? Or are the policies on the SEPMs the same?

Did this work prior?
Did it just start?
Is the client on the same version as the SEPM?

Without access I'm simply speculating so you may need to open a support case so an engineer can remotely access for further troubleshooting.
 

I can see the update in the SEP client settings but it still reverts back to 5 min even when its set to 60 in the SEPM and you see it set to 60 on the SEP client. Is there a bug?

Its not reconnecting to the old SEPM, its getting the new policy but not working.

Possbilty that there is. What is the exact client version experiencing this? The fix notes will need to be checked for this.

12.1.6 (12.1 RU6 MP5) build 7004 (12.1.7004.6500)

If it a bug in this version then support will need to confirm. Since you're working with the latest version there is no document on known issues with this specific version. I can only confirm that in my testing the time is being correctly honored per my policy for this specific version.