Preventing users from disabling protection on client computers

To change the user control level

1. In the console, click Clients.

2. Under View Clients, select the group, and click the Policies tab.

3. Under Location-specific Policies and Settings, under the location you want to modify, expand Location-specific Settings.

4. Next to Client User Interface Control Settings, click Tasks > Edit Settings.

5. In the Client User Interface Control Settings dialog box, do one of the following options:

   • Click Server control, and then click Customize.

     Configure any of the settings, and then click OK.

   • Click Client control.

   • Click Mixed control, and then click Customize.

     Configure any of the settings, and then click OK.

6. Click OK.

To prevent users from disabling the firewall or Application and Device Control

1. In the console, click Clients.

2. Click the client group that you want to restrict, and then click the Policies tab.

3. Expand Location-specific Settings.

4. Next to Client User Interface Control Settings, click Tasks > Edit Settings.

5. Click Server control or Mixed control, and then click Customize.

6. On the Client User Interface Settings dialog box (server control) or pane (mixed control), uncheck Allow the following users to enable and disable the firewall and Allow user to enable and disable the application device control.

7. Click OK, and then click OK again.

To prevent users from disabling intrusion prevention

1. In the console, click Clients.

2. Click the client group that you want to restrict, and then click the policy Policies tab.

3. Expand Location-specific Policies.

4. Next to Intrusion Prevention policy, click Tasks > Edit Policy.

5. Click Intrusion Prevention, and then click the locks next to Enable Network Intrusion Prevention and Enable Browser Intrusion Prevention to lock these features.

6. For version 14 only, click Generic Exploit Mitigation, then click the lock next to Enable Generic Exploit Mitigation to lock this feature.

7. Click OK.

To prevent users from disabling Virus and Spyware Protection

1. In the console, click Clients.

2. Click the client group that you want to restrict, and then click the Policies tab.

3. Expand Location-specific Policies.

4. Next to Virus and Spyware Protection policy, click Tasks > Edit Policy.

5. Under Windows Settings, lock the following features:

   • Click Auto-Protect, and then click the lock next to Enable Auto-Protect.

   • Click Download Protection, and then click the lock next to Enable Download Insight to detect potential risks downloaded files based on file reputation.

   • Click SONAR, and then click the lock next to Enable SONAR.

   • Click Early Launch Anti-Malware Driver, and then click the lock next to Enable Symantec early launch anti-malware.

   • Click Microsoft Outlook Auto-Protect, and then click the lock next to Enable Microsoft Outlook Auto-Protect.

   • For versions earlier than 14.2 RU1, click Internet Email Auto-Protect, and then click the lock next to Enable Internet Email Auto-Protect.

   • For versions earlier than 14.2 RU1, click Lotus Notes Auto-Protect, and then click the lock next to Enable Lotus Notes Auto-Protect.

   • Click Global Scan Options, and then click the locks next to Enable Insight for and Enable Bloodhound heuristic virus detection.

6. Click OK.

To prevent users from disabling Memory Exploit Mitigation (starting in 14.0.1)

In version 14, Memory Exploit Mitigation appeared in the Intrusion Prevention policy and was called Generic Exploit Mitigation.

1. In the console, click Clients.

2. Click the client group that you want to restrict, and then click the policy Policies tab.

3. Expand Location-specific Settings.

4. Next to Memory Exploit Mitigation, click Tasks > Edit Policy.

5. Click Memory Exploit Mitigation, and then click the lock next to Enable Memory Exploit Mitigation.

6. Click OK.