Endpoint Protection

Hello,

I have been receiving e-mail notifications from our SEPM that users are over-riding file reputation downloads where Reputation says there is not enough information or a little evidence that the file is trustworthy.

However we have download protection set to quarantine unproven files in our Antivirus and Antispyware policies.

How can a user over-ride a download when it's supposed to be quarantining these files?

Thank You.

Is this the same policy across all endpoints? Or could this specific group have a different policy applied? If the same policy, perhaps some of these endpoints have a corrupt policy or the policy change never took affect for them. May need to look at one or two of the endpoints to determine that. Open the GUI on the managed client and see what that setting looks like.