Changing Tamper Protection Settings - Symantec 20032623 - Endpoint Protection Small Business Edition Implementation Manual

202 Managing Tamper Protection

Changing Tamper Protection settings

Changing Tamper Protection settings
When a client is installed as a managed client, Tamper Protection has the following
default values:
Tamper Protection is enabled.
The action that Tamper Protection takes when it detects a tamper attempt is
to log the event only.
Tamper Protection does not notify the user when it detects a tamper attempt.
Note: When notifications are enabled for tampering attempts, notifications about
Windows resources are sent to affected computers as well as notifications about
Symantec resources.
See Changing Tamper Protection settings"
When a client is installed as an unmanaged client, Tamper Protection has the
following default values:
Tamper Protection is enabled.
The action that Tamper Protection takes when it detects a tamper attempt is
to block the attempt and log the event.
Tamper Protection notifies the user when it detects a tamper attempt.
You can enable and disable Tamper Protection and configure the action that it
takes when it detects a tampering attempt. You can also configure it to notify
users when it detects a tampering attempt.
Tamper Protection settings are configured globally for a selected group.
A best practice when you initially use Symantec Endpoint Protection Small
Business Edition is to use the action Log the event only while you monitor the
logs once a week. When you are comfortable that you see no false positives, then
set Tamper Protection to Block it and log the event.
See About Tamper Protection"
You can configure a message to appear on clients when Symantec Endpoint
Protection Small Business Edition detects a tamper attempt. By default, notification
messages appear when the software detects a tamper attempt.
The message that you create can contain a mix of text and variables. The variables
are populated with the values that identify characteristics of the attack. If you
use a variable, you must type it exactly as it appears.
on page 202.
on page 201.