symantec endpoint firewall is not functioning correctly

For example, IE11 on Win 10 x(64) when opened in Private mode will run under svchost.exe control just like Edge - consider this a tip. Also IE11 runs differently depending on the OS installed and how it is configured. Rules need to include both IE11 x(64) and x(32) versions. Reviewing that, these processes can be explorer.exe, svchost.exe, ekrn.exe(Eset's BPP), and iexplore.exe - note that IE11 spawns a child process or itself. That is known processes that can launch IE11 when you do so manually via the desktop taskbar. After you do that, run a command on the top level (My Company) under Clients section and do Update Content.ĬLIENT SIDE: To verify what version of definitions on a client workstation, launch Symantec and click on Protection definitions.For known 'parent' / 'child' applications I can create HIPS rules, but they can be in any combination so, without a mechanism which would tell you that a 'parent' is trying to use a 'child', you cannot control access to the internet.Īppears you have part of the HIPS rules you need already figured out. Click Security Definitions -> Select a revision for Intrusion prevention -> Choose 10/22.

SERVER SIDE: To revert back on the server side, go to Symantec Endpoint Protection Manager -> Policies -> Live Update -> LiveUpdate Content Tab -> LiveUpdate Content Policy. We called support and they had us roll back the 'intrusion prevention' signatures from 10/23/14. We're currently testing rolling back the definitions but here are the steps we used. Certain sites were causing IE to freeze and lock the whole computer up but if flash was disabled it worked fine. It took hours to figure out as it looked like a flash issue.

Symantec endpoint firewall is not functioning correctly