Critical System Protection

Not be possible by sepm.

Any possiblity by SCSP ?

You posted this in SCSP, is this the product you're wanting the info on or more for SEP?

Not be sure it help you but see this

https://www-secure.symantec.com/connect/forums/what-will-default-blocked-when-scsp-prevention-enabled

Yes .Brian wanting info regarding SCSP

Short answer; yes.  It is possible using CSP (DCS).

Deploy an appropriate prevention policy that denies access to the relevant resources.  I'm thinking registry keys, etc.

Best way to figure out which one is it is to put on a normal prevention policy, then recreate what you are attempting to prevent.  Then look in the logs for the rules which are triggered and why, then you can create a new prevention policy with those bits in there.

Thanks Alex.. I want to make two user group Admin and Normal user and for normal user restrictions are like that 1. Not delete self and other accounts 2. allow only installation of particular trusted software from particular drive so how to achieve this by SCSP policy... where to define Trusted Software and drive to allow installation for normal user and block any other software installation from any other locations.

What version of SCSP are you using ?

SDCSS 6.0

You can use the trusted installers section then.  Couple that with admin usernames that will then only allow those installers to install on those specific users.

Alex.. I use sym_win_protection_core_sbp policy so how could I use trusted installer section in that please explain if there is a way to do so

You're using a 5.2.9 policy within the 6.0 client.  The trusted installers was introduced as part of 6.0.  Create a new policy using the wizard.

Thanks Alex..

it shows only 5.2.9 policies how can I create 6.0

If you create a new policy rather than copying an existing template, it will utilise the new 6.0.0 policies.