Endpoint Protection

We recently had an occasion where it would have been beneficial to immediately shut down one of our SEP MR5 clients. I know we have the ability to restart a client, but do we have the ability to shut them down too?  

No there isn't however an Idea for this has been already added long time back

https://www-secure.symantec.com/connect/idea/automatic-shutdown-after-full-scan

https://www-secure.symantec.com/connect/idea/post-scan-action

https://www-secure.symantec.com/connect/idea/action-after-scheduled-scan

Thanks Vikram!

technically there is a way to kill a machine.  I have not tested it yet but you could create a special group, use application and device control to terminate winlogin or some other necssary process.

Hi Jeff,

Teciincally you are right but killing WinLogon.exe would be the harshest way to shutdown the computer 

Oh I agree it would be harsh.  I'm not sure even booting into safemode would work, unless ADC would be disabled in safemode. 

However, depending upon the reason for shutting the system down... it might be necessary.  If a machine was actively attacking internal resources or worse reported stolen with PII.  It may be necessary to kill a machine. 

Thats correct In extreme situations this method is applicable but not for day-to-day function.

Just to shutdown after reboot this option is very unstable and can harm OS and other Apps

Bryon,

Vikram is correct.  The method I provided should only be used in a worst-case scenario.  If you are using SNAC you could accomplish a clean shutdown (I think) by again a special group with a policy that goes something like this:

If process x (somethign you know to be running) if active,

Then run executable to shutdown the system.  You could easily deploy the psshutdown (or other utility) ahead of time and call that executable.

Best of luck

I've heard Symantec either has or is putting out a product called EI Power. It works with Altiris and you can use it to boot up machines, run whatever task is needed then shut it down.