Hello,
I'm trying to determine what user added exceptions in the Symantec Endpoint Manager (SEPM 14). I dont see a log of who made the change, is it possible to enable this type of logging?
Nope - not possible. I believe this has been raised as a product enhancement request in the past though to add some sort of description field or audit trail capability.
Do you have SCCM in place? You can get the DCM to report the reg key values where exception details are stored.