Endpoint Protection

hi all

i want to ask is there a problem with the security settings in the new MR5, or is just a problem in ny company.
Namelly, we upgraded our SEP11 platform from MR4 to MR5 and in the last 3-4 days i've noticed that all the useres could disable the SEP clients on there PCs, and stop all serveces that they please. I' ve tried to find any sence in this but there is no one. The sec settings were working great until the upgrade.

any ideas???

p.s. I also tried to add a password for starting the client user interface (the option that wasn't acctivated before, and this dont work also)

Hello tylerMK
Does your clients comminicate with SEP manager? Do they take new policyies?
thanks
Fatih

TRY THIS DOC
How to block a user's ability to disable Symantec Endpoint Protection on Clients
 Ensure latest policy is available in the client
For this you can match the policy sl. no in server and client
In server you can find the policy sl. no in Clients---><preferred group>-->details tab
In client help and support--->troubleshooting..

the policy should still in place after migration
check if clients are in same group or different group

thanks for the fast replays people :)

as a clarification there is a clent server comuunication, and all the clents are geting the new policies from the server. All other fitures are working perfectlly, inceluding the the blocking of some applications ande devices on a user level which means that all the policies are ok exept for the sec setting that does not function.

I will  try the solution in AravindKM post when i can and will inform you of the results, but if you have any more ideas dont hasetate to throw them my way

Maybe you can try to force the policy again: change a thing, save and than change back to the values you really would like to have.
We see also strange thing over here after doing an upgrade from MR4 to RU5: in the tab policies of a certain group we see the policy 'antivirus and antispyware policy for DBB TS' and that policy is active but if we than switch to the policies tab (left side of the screen) we see 0 for Location Use Count for the policy 'antivirus and antispyware policy for DBB TS' . Strange...

Another idea is enable tamper protection
below doc can help you in this
How to configure Tamper Protection in Symantec Endpoint Protection 11.0 
You can also create  password for opening the user interface or for stopping the smc service .Tis you can do in clients -> policies -> general settings for a group and in security settings set a password to stop client service
See the picture in the post Disable Client ability to remove SEP
You can also remove the option "display the notification area icon " from clients -> policies ->client user interface control settings---->server control--->customize 

nope. none of the solutions works :((

i already have all set it up. The tamper protection setup as well as the sec setting was working ok until the upgrade. I also have tried the changing the policies a bit, updating the content to the users and then changing the policy back (done it a few times before allready) but that does not work either

Check for any policy change happened in the group policy recently if not helps log a call with symantec support... 

so guys....

I've neglected this questions for some period of time cause i was very busy, but today i made some tests and discover the following:

1) When i install a new version of SEP11.0.4, all the policies and sec settings are working just fine
2) When i install a new version of SEP11.0.5,a also all the policies and sec settings are working just fine
3) But, when i upgrade an already installed SEP11.0.4 version to 11.0.5 all the policies are working corectlly, but the sec setings are all mest up.

Have anyone encountered this kind of behaviour and offcourse if there is a solution i will be very glead to get it (because a person will have to be crazy to install 1500+ SEP11.0.5 from scratch)

:))

you have security settings enabled on all the groups or few groups?
when you upgrade do the clients change groups?
 

yes and no.

Sec setiings are enabled on all the groups, and are still valid for the clients that were not upgraded, and the clients never change groups during upgrade

Do the policy numbers on the configuration group and the SEP client match?
You need to ensure these are matching to prove that the clients are getting the correct policy from the server.

I would then try exporting the sylink.xml and dropping it on a client to see if that fixes things.

the policy numbers on teh clients match the groups policies for all groups.

replacing the sylink file is not an option because i have a couple groups that are not supose to have the same privelages as all the other users, and replacing the sylink will mean that the users will change priveleges, and before you say replace the sylink manually with the sylink from a user that has funcioning sec settings in the same groupe i have to remind you that i have more than 1500 pc's

thanks for the interes anyway :)

for anyone who is interested in the solution of this problem.
what I did is the following:

in the already existing groups that contain SEP11 MR4 packets i added new MR5 pck. During the creation of this packet, in the clinet fiatures, I chose NOT to maintain the existing features when updating. Because the package is in the same group as the old version it will maintaing this features eventhogh I've selected not to maintain the same features :))

After a while all the users in the designated group got updated and the sec setings were as the are sopopse to be.
another good thing that come from this is that the pcs that the sec setings all mest up, when they got updated the seting got to work just fine