how to check if policies / exceptions are applied to endpoints?

Question

Hi guys, 
 having a (performance) problem with an application. I built a new policy / enhanced the Base Policy and added some (file and process) exceptions. How can I check on one particular client if these exceptions are working as they should? 
 Using Intercept X Advanced on the Windows 10 endpoints. 
 Thanks in advance.

Sophos User930 · Accepted Answer

You can check the registry keys under: 
 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\Scanning\Config 
 if you made an exclusion.

Marcel · Answer

The fastest method to check if new policies are applied is to use the Endpoint Self Help Tool. Within the Endpoint Self Help Tool you can see under "Management Communication" when a computer successfully communicated with Sophos Central. Additionally you can look at the "Policy" tab where it will display timestamps for the various policy types. 
 Please note that when running Intercept X Advanced on a server that you should disable Windows Defender, see: https://support.sophos.com/support/s/article/KB-000042286 (this only applies to Server OS's).

Qoosh · Answer

One way you can verify if your exclusions are working correctly is by using an EICAR test file. Further information can be found in the following article. - Sophos Endpoint: Test detection features 
 If you have a folder exclusion, placing the eicar file within the excluded directory will work to test this in real-time. For process exclusions you may want to get a baseline for speed first without the exclusion present and then test after the exclusion is added.

chaosweb2 · Answer

Thanks!

how to check if policies / exceptions are applied to endpoints?

Top Replies