Endpoint Protection

 View Only

  • 1.  SEPM Users changes

    Posted Jun 17, 2014 10:22 AM

    Hi

    Is there any way to know what has been changed on SEPM and by which any user?????

    Thanks



  • 2.  RE: SEPM Users changes

    Posted Jun 17, 2014 10:25 AM

    See pete comments

    In SEPM -Reports- Quick Reports -Audit , this will show the policy change and the user made it

     

    Audit The Audit report contains information about policy modification activities, such as the event times and types, policy modifications, domains, sites, administrators, and descriptions

    https://www-secure.symantec.com/connect/ideas/need-track-logs-changed-sepm-policy



  • 3.  RE: SEPM Users changes

    Posted Jun 17, 2014 10:44 AM

    Go to the Monitors page >> Logs tab

    Set Log type to Audit

    You can select Advanced Settings for more granular searches

    Click View Log

    All changes made on the SEPM will be disaplyed



  • 4.  RE: SEPM Users changes

    Posted Jun 17, 2014 11:12 AM

    But it does not show where was the change in which group or OU and what exactly was change in the firewall policy, is there any way to get any more information???

     

    Event type: Policy edited
    Description: Edited shared Firewall policy: Firewall policy
    Domain: ------------
    Site: JEDDC
    Server: JEDSEPM02
    Time: 04/28/2014 13:43:15
    Policy: Firewall policy
    Administrator: admin


  • 5.  RE: SEPM Users changes

    Posted Jun 17, 2014 11:14 AM

    There is not, it only shows the high level change.