Prevent end users from changing AV log retention for SEP client
Updated: 09 Feb 2010 | 5 comments
Status:
In Development
(re-posting previously requested item)
Wish to be able to lock the end users ability to modify the local AV/AS log retention period for the local SEP client. This will ensure end users can't lower the configured period can cause a situation where a machine is off the network, gets infected, the AV/AS log is purged and then the machine connects to the network, thus meaning the central admin is unaware of the infection.
Comments
Log retention - for forensics
I would like to be able to set the client log and not have it editable so an end user can not remove logs that need to be used to tracking or other forensics. I can see several reasons to let the adminstrator control that retention and the end user not being able to configure it.
This option should be
This option should be included with the other polices....
Regards,
Srinivas H.P.
HCL Infosystems Ltd
For clarity, the option in
For clarity, the option in question is:
The option "Delete logs older than x days"
There is no padlock against this setting, and users can change it on the client side. This brings compliance issues as users can delete log files from their PC. This was logged as tech support case 281-889-718 however it was closed as the product is working "As designed". The solution was to disable the Client SEP GUI, however this has other issues, eg how does the user perform a manual scan? How do they determine the current definitions in use? How can they see the policy serial number? etc.
Every other policy option (with the exception of Quarantine) is able to be locked down, why not this one?
g
This change is being targeted
This change is being targeted for a release later this year.
JimW
Jim Waggoner Director Product Management, Symantec Endpoint Protection, Enterprise Security Group, Symantec
Restriction of local log retention
Jim has this feature (locking of the local retention logs been added to any newer revisions of SEP since your last post?
Thanks for any information, Dennis
Would you like to reply?
Login or Register to post your comment.