Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 13 replies
  • Subscribers 19 subscribers
  • Views 45155 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Option to prevent tampering with Sophos services and settings

ksmith0724

Hello Folks -

We just recently implemented Sophos S&C 9.0 for our end-users.  The product works great but we are looking for some sort of mechanism to prevent our limited number of users who are also local administrators on their laptops from stopping the Sophos services.  I know with other vendors products that regardless of whether the user is an admin or not they still provided some sort of setting(s) that would prevent the users from doing so.

I do realize (and I saw this on other posts in this forum) that it doesn't go along with "safe computing practices" but in some companies (i.e. telecoms) it is often at times cumbersome to lock down certain departments (RF engineers, field crews, etc) especially when these departments are in direct contact with vendors, etc.  I can restrict with a Group Policy the "Install with Elevated Privilges" settings but many applications are hard coded to require an administrator installing the software.

I saw that Sophos Professional Services can assist with this type of configuration but in my honest opinion this is something that should be included in an enterprise class endpoint solution.  I also may be searching on the wrong keywords so if there is an article / suggestion on how to accomplish this please steer me in the correct direction.

Thanks!

:2028


This thread was automatically locked due to age.
Parents
  • 0

    I realize that local admins have the rights to do other things than disable A/V.  But when we trialed other endpoint security solutions prior to purchasing Sophos they have had the option to prevent users from killing the process or disabling the services, including local admins.  I think this is a very useful feature and truly makes a solution tamperproof.

    If someone is able to compromise a computer with admin permissions it would seem pretty easy for them to end the process and load all the malware they wish.

    Is there even any way of properly detecting that someone did this via the management console?

    :55137
Reply
  • 0

    I realize that local admins have the rights to do other things than disable A/V.  But when we trialed other endpoint security solutions prior to purchasing Sophos they have had the option to prevent users from killing the process or disabling the services, including local admins.  I think this is a very useful feature and truly makes a solution tamperproof.

    If someone is able to compromise a computer with admin permissions it would seem pretty easy for them to end the process and load all the malware they wish.

    Is there even any way of properly detecting that someone did this via the management console?

    :55137
Children
No Data
Unfiltered HTML