Endpoint Protection

 View Only

  • 1.  What does Disable Feature indicate?

    Posted Jun 11, 2013 06:48 AM
      |   view attached

    Please find the below attached secreen shot .

    What does the Disable Feature indicate in SEPM in 12.1 RU2 Home Page.



  • 2.  RE: What does Disable Feature indicate?

    Posted Jun 11, 2013 06:54 AM

     you can click on Disabled, it will open a new window with a better view.

    From here, scroll over and you can see status on such things as AV, Firewall, SONAR, Download Insight, NIPS, Browser IPS, and tamper protection.

    It is likely one of these is disabled. You can than go to the client and check.

    The disabled state is a little misleading. You need to actually open it up to find out what.

    It should read something like "Component Disabled" instead.



  • 3.  RE: What does Disable Feature indicate?

    Posted Jun 11, 2013 09:21 AM

    Disabled just means that one of the components in SEP is disabled.

    It is a little misleading as it gives the impressions SEP is completely disabled. But it usually means only a component is (AV, NTP, PTP, tamper protection, download insight, etc) depending on which ones you have installed. You need to click on it for a new window to open which will give you a better idea.



  • 4.  RE: What does Disable Feature indicate?

    Posted Jul 01, 2013 04:15 AM

    Clients listed under the status disabled may indicate that one of the following components is malfunctioning - you would need to expand the details section to see exactly which one is it - it does not mean the whole SEP client is disabled or not working. The possible components are:

    • Auto-Protect Status
    • Firewall Status
    • Sonar Status
    • Download Insight Status
    • Network Intrusion Prevention Status
    • Browser Intrusion Prevention IE Status
    • Browser Intrusion Prevention Firefox Status
    • Tamper Protection Status


  • 5.  RE: What does Disable Feature indicate?

    Posted Jul 01, 2013 08:13 AM

    Further to the above, it's worth bearing in mind that SEP Clients with the firewall installed but disabled by withdrawing the FW policy, also erroneously contibute towards this "Disabled" count.  This started in RU2, but has continued into RU2MP1 and RU3 for some unfathomable reason (worked fine before that surprise).

    Oddly enough, IPS still reports correctly as "Disabled by Policy" so it's not like the functionality was somehow lost, it just doesn't seem to work for the FW component anymore.

    #EDIT#
    This rang a bell, and I remembered I created an IDEA about the whole FW state thing as below:

    https://www-secure.symantec.com/connect/ideas/differentiate-between-different-sep-client-fw-states

    This is only applicable to you if it is the FW states that is causing the "Disable" count to go up on your SEPM though