Endpoint Protection

 View Only

  • 1.  Restrict Admin users from terminating the SEP scan

    Posted Nov 02, 2015 01:16 AM

    Local admin users are capable of terminating the scan process using the Task Manager which results in unfinished scans .

    I am looking for options inside SEPM or if it can be achieved by some other means.

     

     



  • 2.  RE: Restrict Admin users from terminating the SEP scan

    Posted Nov 02, 2015 02:46 AM

    Table: Advanced user options

    Option
    Description
    Scan progress Specifies what users see on their computers when a scan is running

    Select one of the following:
    · Do not show scan progress
    · Show scan progress
    · Show scan progress if risk detected
    Close the scan progress window when done Specifies that the scan progress window closes automatically when the scan is finished

    This option becomes available when you select Show Scan progress.
    Allow the user to stop the scan Allows users to stop scans that start on their computers

    This option becomes available when you select Show Scan progress.
    Allow the user to pause or delay a scan Allow users to pause or snooze the scans that start on their computers

    This option to delay a scan becomes available when you select Show Scan progress.

    Symantec Endpoint Protection Manager - Antivirus and Antispyware - Policies explained 

     

    disable the option "Allow the user to stop the scan and Allow the user to pause or delay a scan



  • 3.  RE: Restrict Admin users from terminating the SEP scan

    Posted Nov 02, 2015 03:04 AM

    Thanks Praveen!

    I hope you would be doing great . I would recheck the options in a testing environment.

    Being specific again with the information  , scans running under application tab in Task Manager 'Can be Ended' by users with Local admin privileges .

    We have allowed the users to Pause or Snooze the scan for maximum of 3 instances .

     



  • 4.  RE: Restrict Admin users from terminating the SEP scan

    Posted Nov 02, 2015 06:12 AM

    what version of sep are you using ? and have to enabled the tamper protection ?



  • 5.  RE: Restrict Admin users from terminating the SEP scan

    Posted Nov 02, 2015 06:20 AM

    1). Choosing " Do not show scan progress " it self, would make sure that the Scan process does not get populated in the Applications tab.

    Following which users won't be able to "End Task" the scan from Task manager .

    Although our requirement is to provide the user with the option to Snooze or Pause the scan .

     

    2). If we make the configuration for the user to snooze the scan , that would again bring up the scan progress UI to the desktop and user would have option to 'End Task' it .

    Any further suggestions would be greatly appreciated .



  • 6.  RE: Restrict Admin users from terminating the SEP scan

    Posted Nov 02, 2015 06:29 AM

    Do you have tamper protection enabled?

    About Tamper Protection

    Disabling this would allow users to kill SEP services.



  • 7.  RE: Restrict Admin users from terminating the SEP scan

    Posted Nov 02, 2015 08:45 AM

    Brian ,

    Tamper Protection is obviously enabled and as I see it , it seems to be working as expected.

    Are we expecting Tamper Protection to Protect the scan populated in here as well :

     

     

    Running_Scan.PNG

     

    What I found , is if the scan is visible here It can be "Ended" using "End Task"

     

    As discussed earlier with Praveen here , If I hide the Scan from the end user , its just a Computer Process running in background and Tamper Protection restrict users from playing with it .

     

     



  • 8.  RE: Restrict Admin users from terminating the SEP scan

    Posted Nov 02, 2015 08:55 AM

    Then if that's truly the case it's a flaw in the design. I don't allow my users to touch the scan so I can't say from experience but can test.



  • 9.  RE: Restrict Admin users from terminating the SEP scan

    Broadcom Employee
    Posted Nov 02, 2015 11:57 AM

    Hi,

    In the screenshot it's showing Active scan not scheduled scan.

    You can configure whether or not the scan progress dialog box appears on Windows client computers. If you allow the dialog box to appear on client computers, users are always allowed to pause or delay an administrator-defined scan.

    When you allow users to view scan progress, a link appears in the main pages of the client UI to display scan progress for the currently running scan. A link to reschedule the next scheduled scan also appears.

    You can allow the user to perform the following scan actions:

     
     

    Pause

    When a user pauses a scan, the Scan Results dialog box remains open and waits for the user to either continue or abort the scan. If the computer is turned off, the paused scan does not continue.
     

    Snooze

    When a user snoozes a scheduled scan, the user has the option of snoozing the scan for one hour or three hours. The number of snoozes is configurable. When a scan snoozes, the Scan Results dialog box closes; it reappears when the snooze period ends and the scan resumes.
     

    Stop

    When a user stops a scan, the scan usually stops immediately. If a user stops a scan while the client software scans a compressed file, the scan does not stop immediately. In this case, the scan stops as soon as the compressed file has been scanned. A stopped scan does not restart.

    Please refer this article:



  • 10.  RE: Restrict Admin users from terminating the SEP scan

    Posted Nov 05, 2015 07:26 AM

    Active scan was just for the reference . I was trying to convey that the scan gets populated under application tab and that's where the user gets privilege to End Task it . Issue is with the scheduled full scans.

    I can hide the scan ( or configure it to come up, only once there is a detection ) to nullyfy the risk, but Idea of keeping the End Users informed would not get a satisfying answer .

    Things seems not to be working out .Might I use the GPO policy but I was so sure that SEPM would have a fix internally .I tried with few configurations to figure out the solution and  GPO policy has its own set of  limitations .