topic Re: Disable Threat Protection in Mac OS in Endpoint

Disable Threat Protection in Mac OS

Jose_Ferreira — Wed, 20 Feb 2019 11:28:28 GMT

We have Endpoint Security (80.89.0076) in Mac computers, and users can disable the Threat Protection by selecting "QUIT" in the agent menu.

Is there anyway to prevent it?

Can I set a password to protect agent?

tks

PhoneBoy — Sat, 23 Feb 2019 05:01:51 GMT

I think that just quits the UI and not the protection SandBlast Agent provides.

Have you confirmed otherwise?

Jose_Ferreira — Mon, 25 Feb 2019 11:00:48 GMT

It stops all process in the machine after click on QUIT.

PhoneBoy — Mon, 25 Feb 2019 18:08:52 GMT

User processes are for the UI.

At least on Windows, there are also kernel processes that run (i.e. that won't show in a ps output).

I don't have a Mac with E80.89 handy to check, but even in E80.64, the firewall is still active if I quit the application.

That's because it operates as a kernel module.

I imagine other SBA protections also operate in this manner as well.