So my question is: How can I force the SEPM to send down a policy that disables (unchecks) the Tamper Protect box? I know that I can switch to server control mode for a couple hours and the setting will be sent down to all online clients.but that seems like a kludgy way to do things and only gets the online clients. Tamper Protection blocks modifications to Symantec Endpoint Protection registry settings, files, and prevents tampering with running processes on Windows. The problem is this, we run in 'Mixed Mode' and every time a new client comes out (MP2 in this case) and is pushed down from our SEPM, Tamper Protect gets re-enabled or if it's a new install, tamper protect is enable by default. The importance of cryptographic systems underpinning encryption, digital signing and authentication, requires a flexible management framework that includes secure key management and. Tamper Protect seems to conflict with our two factor authentication software and unfortunately.upgrading the two factor software is not an option.

You may also experience a system hang when Tamper Protection is enabled while running ClearCase. We have an issue with SEP (and SAV for that matter) assisting in a BSOD with a stop 50 error if 'Tamper Protect' is enabled when a machine is rebooted. Symantec Endpoint Protection, prior to 14.3, can potentially reset the ACLs on a file as a limited user while Symantec Endpoint Protections Tamper. When Tamper Protection is enabled in Symantec, the following warning is reported in the Credentials Manager (cccredmgr) log: cccredmgr (556): Warning: OpenProcessToken failed: Error 5: No additional description available for this system error.

Tamper protection symantec