Endpoint Protection

Hi,

Currently I am using SEP 14 MP2. Is there any method to remove or grey out the "Uninstall" option? We do not allow our user to uninstall the SEP.

Thanks.

When you apply the steps below does it not come up with a password when the user tries to uninstall? Preventing the user from uninstalling. 

1. Open the console manager.
2. Click Clients.
3. Select Policies tab.
4. Click on General Settings.
5. Select Security Settings tab.
6. Select Require a password to uninstall the client.
7. Type the <password> in the box.
8. Click OK.

Hi GeoGeo, 

May I know for the step you mention at above, will it work for SEP in Mac?

Thanks.

Yes they should do if the MAC is centrally managed by the SEPM 

Open the SEPM console > Clients > select group the MAC machines are in > Policies tab at top > Password Settings > tick requires password for uninstall > enter password and click ok 

On next heartbeat machines will pick up the password policy 

Can I conclude that, "Password" at the group policy is the only method to prevent Mac user to uninstall the SEP in 14 MP2?

As far as I'm aware yes 

Hi. Symantec Endpoint Protection for Macintosh Frequently Asked Questions (SEP for Mac FAQ) https://support.symantec.com/en_US/article.TECH134203.html

You may want to double check that, as far asI know, passwords set within the SEPM do not apply to Macs.

Q. There's no Add or Remove programs for Mac. How do I uninstall?
A. As of version 14, you can uninstall through the menu. Click on the shield icon, and then click Uninstall. Enter an administrative password when prompted. Since a restart is required to complete uninstallation, you should save all open work before you begin. For a managed client, if you set a password to uninstall the client (through Clients > Policies > Location-independent Policies and Settings > Settings > Password), it does not apply to Mac clients.

I have test it, the password setting not working for Mac. Is that mean currently there are no any option for Mac to prevent their user uninstall SEP?

Doesn't appear to be using SEP, no.

Hi Brian,

Can you elaborate "Doesn't appear to be using SEP, no.".

Thanks.

What I mean is I don't see a way to stop Mac users from removing SEP using the password protection feature that Windows clients have.

Hi Brian,

So as far i see, if is the mac user is a system admininstrator there is no way to block the uninstallation of symantec for mac user from the manager.

If the client is still on version 12 and the manager is on v14 will this still apply ?

I do believe so.

The best approach for hiding the Uninstall option is to hide the SEP menulet icon. 

Select client > Group Macs are in > Settings for Location: Default (Internal) > Expand Location-Specific Settings > Client User Interface Control Settings: Server control > Click Customize... Uncheck the Display the notification area icon.

 

This works for Macs? I've gotten this to work for SEP clients running Windows.

That's how we configure the policy for our fleet of ~500 Macs. Well up until recently, there is a bug with Active Directory integrated v14 SEPMs and Macs. Macs will only show up in the Default group under My Company. Also there's no way for us to stop Mac users with local admin to run the Symantec Removal tools or any other script to remove the client.