Hi,
i believe you are talking of the SEP service. did you verify is the policy has been applied on the client by comparing the policy number in SEPM console and the same on SEP client GUI.

this settings is only prevent the smc service, not the SEP service (real scan). TO stop end users disabling SEP service, enable tamper protection.

Pete!

Hi Nel can you check this document?

http://service1.symantec.com/SUPPORT/ent-security....

you can lock the respective features from the antivirus and antispyware policies, like file system auto protect, internet email auto protect, lotus notes auto protect, microsoft outlook auto protect. In yours case if you lock the file system auto protect then users will not be able to disable SEP, as disabling SEP means disabling the auto protect feature

That is right Sapta...
all policies could be bypassed  if they would disable it in the tray...
here is a screenshot below.

@paul: I will be reading the link you sent thoroughly.
Give you feedback later after I implement it.
thanks.

@Paul Mapacpac: I had already implemented it.
few changes were made to cater our org.
It has been several minutes now and they could still disable it..
By the way, How many minutes would the update contets command take effect on the clients?
I might wait for another 10 minutes for resolution..
might also reboot the clients..
Will give progress afetrwards.
thanks..

it seems that there is no way to block the disabling the antivirus protection

stoping client service only stops the connection SEP with SEPM

i set 3 minutes (minimal time) to enable protection after disabling

if a client is logged in as a domain user then the disable SEP option is automatically disabled, but in administrator login it is not disabled, have you tried to lock the features?

Hi Sapta, what if he is logged in as a domain user, but added to the local administrators group?

hi paul,
normally clients are not added to the local administrators group, this is a wild guess i told about, considering the fact that the user is login as a normal domain users a/c. But if it is already added to the local administrators group then user can disable it as per your saying.

hi,

administrator domain/local the feature is not disabled.

Pete!

Hi Pete,

I read your thread, and I have the exact same issue- domain user, not domain user, admin, not admin, only on 30 machines. 

You did not mention the OS that the users were using.  In my experience, and it is well known at Symnatec, this feature does not work on 64 bit machines.  All 30 of my machines that are experiencing this are 64 bit...

Are your clients in 64 bit?

If you open up the SEPM console, on the main page, in the bottom left hand side, below status summary, there is an indicator that states: "Tamper protection off" with a number.  Clicking on the number should give you a list of all the machines that this feature is not working for.

Is it all the machines?  A specific group?  Or possibly a specific OS?

Let me know if this helps:

1. Logon to the Symantec Endpoint Protection Manager Console
2. Browse to Clients
3. Select the Group
4. Click Policies
5. Expand Location-specific Settings
6. Click on Tasks to the right of Client User Interface Control Settings
7. Click on Edit Settings
8. Click on Customize to the right of Server Control
9. To restrict access to the Symantec Endpoint protection tray icon, un-check the Display the notification area option.
10. To restrict access to the Symantec Endpoint protection tray icon and the user interface, un-check the Display the client option.
11. Click OK
12. Click OK to save changes to the location specific settings policy

Hi,

just to clarify: "Disable SEP" does not mean "disable anything" but just what it is possible to disable. If some features are not disabled and locked as described above (Paul and Sandip's posts) you will still see "Disable SEP" enabled to disable them.
Just for example: if you lock the auto-protect for file system but not the outlook protection, you have "disable SEP" in your clients to disable the outlook protection but not the auto-protect.
If you test the "DIsable SEP" function under different conditions you will see that the interface of SEP will tell you exactly which components are disabled.
It is already well tested.

What Kedar has said is actually the right way to go ahead and disable the users ability to disable SEP.

Here's a link to help you out:
http://service1.symantec.com/support/ent-security....

It seems that a few users have been having this problems since:
https://www-secure.symantec.com/connect/forums/disabling-user-access-disable-symantec-endpoint-protection?sym=TRUE

I think users should not have access to the option to disable SEP by default imho.

@sandip_sali: Already did that but still having issues.

@Kedar Mohile: I had already implemented it. "To restrict access to the Symantec Endpoint protection tray icon, un-check the Display the notification area option. "
I had already update content from the server console and click update policy in the client.
but it is still not working maybe i shall need some time for it to take effect... normally, how long would it take? thanks.

Please make sure that the upper level policies are not inherited to that group.

@Paul Mapacpac: not inherited. thanks.

@all: Thanks! It worked on all user accounts like what Sapta told on the thread...
@Sapta: I voted you a point for that comment.. it helped... thanks..
@paul: thanks for the constant advices... you rock...

@all: Just one more follow up... could we make several admin accounts not disable SEP in the tray?
 thanks...

@Dperfectgent: Which in particular made it to work? Maybe it's time to update the KB for that. As for the admin account, this could be a new thread.

it worked on the user accounts.. it is totally grayed out..
but using an admin account, it could still disable symantec.. even though i had already made all possible procedures in this thread...
We just need to know if an admin account could be blocked from disabling symantec.

thanks.. 

If your client admins share the same policy as your users then they shouldn't have any more rights to the client.

If you open the GUI itself and click the options buttons, which ones have "Disable..." not greyed out?

@Paul Murgatroyd: the user accounts are already disabled but the admin still could right click the symantec icon on the system tray and disable it. What I did was to hide the tray totally but it is just a remedy.. hope we find a solution since other admins would just disable Symantec and no AV at all.

thanks.

Thats why I want to know WHICH components can be disabled in the GUI.  As previous people have said, the "Disable SEP" link in the system tray only relates to those components which for some reason havent been locked down.  If your users are unable to disable the product then the same should be true for your administrators.  It could be a bug in the system tray code, but check the client GUI and tell us which components do not have "Disable..." greyed out.

@Paul,

What you're saying is that the Disable option would only allow clients to disable the items not greyed out in the GUI?

I currently have "Network Threat Protection" locked on the GUI in the "Change Settings". On the "Options" on the "Status Page", I can see that the "Change Settings..." is greyed out. I can still disable the SEP in the System tray and the Network Threat Protection was also disabled when I do so.

I have tried to re-create the scenario and it seems if you are a member of the admin group the policy to disable SEP is available. But for a normal user (no admin rights) the policy is applied.

I also have same problem is there any other option if a user has admin rights not disable the sep.