Endpoint Protection

Hi Everyone,

      I have configured the Download Insight Actions such that from defualt to i have set,

First Action                Quarantine risk

If first action fails         Delete risk

once after saving the settings and restarting the system it is going back to the defualt settings as below

First Action                Quarantine risk

If first action fails         Leave alone(log only)

can anyone help how to save the user defined configurations permanantly.

I am using SEP 12.1.7004.6500

corresponding screen shots are attached.

These policy changes should be made in the SEPM AV policy. What's happening is the SEPM policy is overriding the user changes because the SEPM policy is different. You can make the changes on the client end but once the client checks in to the SEPM, it will use the SEPM policy.

I have the same issue on unmanaged clients.  " If first action fails it keeps defaulting to leave alone"  I have brought this to the attention to Symantec Endpoint Protection Support first back in May 2015 and numerous times after and they have not fixed the bug.  I have been contacted by Engineering and they told me they are working on a fix and for some unknown reasons they keep closing the support case that I keep openeing to find out the status.  It has been over a year that this bug has been happening.  I have been a Symantec customer since 1996 and have never seen anything take so long to resolve.

It was not even sorout in SEP 12.1.7061.6600, as i already mentioned mine is unmanaged client which i am using at my home computer

Hi BKATC,

      It's very sad to see that in latest version of SEP 12.1.7061.6600 which was released on 16th Sep 2016 our query bug was not fixed.

We ran into this exact same issue after upgrading unmanaged clients to SEP 12.1.6 MP6.   The unmanaged clients do no connect to the SEPM.  We've contacted Symantec also.

Does anyone have a workaround for this?
 

Have you tried running cleawipe?

I think it has been fixed in SEP 14, Check "New Fixed"

Auto-Protect and Download Insight Actions revert to defaults when in Client Control mode

FIX ID: 3852067

Symptom: When the Symantec Endpoint Protection client receives any new policy while in Client Control mode, user-defined settings for Auto-Protect and Download Insight are deleted and replaced with the default values.

Solution: User-defined Auto-Protect and Download Insight settings are no longer reset to default values whenever a new policy is applied to a client in Client Control mode.

All's well and good that it's fixed in SEP 14, but we need a fix for SEP 12.1.6 MP6.  Is there a registry tweak maybe to set the defaults to what we want?  Has anybody tried upgrading using the client only patches?

We opened a case with support.  Here's what we found out. 

We were told that the bug will not be fixed in SEP 12.1.  The workaround for SEP 12.1 is to make the unmanaged client a managed client, e.g. switch it from client control mode to server control mode.  The bug presents only on clients that are in client control mode (unmanaged clients).  

Othewise, upgrade to SEP 14.  The bug is fixed in SEP 14.  We've tested SEP 14 and verified that our Download Insight settings were carried forward from SEP 12.1 and remain so after rebooting.