Hi,

Is there any option on SEPM to Isolate infected machines from accessing internet and local network until it is cleaned.

Thanks

See this

Best Practices for Troubleshooting Viruses on a Network

What is Risk Tracer?

How to use Risk Tracer to locate the source of a threat in Symantec Endpoint Protection

See mick2009 articles

https://www-secure.symantec.com/connect/articles/day-after-necessary-steps-after-virus-outbreak

https://www-secure.symantec.com/connect/articles/two-reasons-why-ips-must-have-your-network

No but you can get creative with the firewall, see my article on how I handle these issues:

https://www-secure.symantec.com/connect/articles/how-utilize-sep-121-incident-response-part-5

And a few others for Incident Response:

https://www-secure.symantec.com/connect/articles/how-utilize-sep-121-incident-response-part-1

https://www-secure.symantec.com/connect/articles/how-utilize-sep-121-incident-response-part-2

https://www-secure.symantec.com/connect/articles/how-utilize-sep-121-incident-response-part-3

https://www-secure.symantec.com/connect/articles/how-utilize-sep-121-incident-response-part-4

Hi TheSniper_,

Symantec Network Access Control (SNAC) is a slightly different product which works with SEP.  It can put non-compliant computers onto an isolated quarantine network.  That's about the closest thing to what you are inquiring about.

Personally, I just pull the network cable to ensure that the suspicious computer will not be infecting any others.

What actions or symptoms are you seeing / what is making you suspect the computer?

Many thanks in advance,

Mick

Mick2009, i tried SNAC before and it caused so much issues in our enviroment, so i am looking for a solution with the box SEPM