Endpoint Protection

Good Day,

           So here is the issue.  I manage an environment of about 18000 endpoints, mixed environment (SEP11/12).  SEPM is at 12.1.4.MP1a.  I want to be able to create a test group where I can move clients to that I want to temporarily disable SEP on COMPLETLY.  I get alot of requests from the intel/deskside team to disable a client for testing purposes. 

I created a group with these settings, Tamper protect is OFF, auto-protect is OFF.  is this enough? or do I need to do anything on firewall rules aspect?

 

Thanks

If you want to temporarily disable everything, then withdraw all policies except AV and LiveUpdate (they cannot be withdrawn) and in the AV policy simply uncheck the auto-protect box to disable it. Same for tamper protection. Simple as that.

Brian,

Thanks for your reply.  I had a group created with those exact settings, I even set the commuication to PUSH for that group.  I moved a client into the group and NOTHING.  Its been like 25mins.

If you open the client and go to Help >> Troubleshooting, does it show connected to the SEPM? Does the icon have the green dot on it?

yup. still connected and still with dreen dot.

Did you verify the policy on the client matched what's in the SEPM? Client was moved to new group?