Hi Team,
we're planning to use Lockdown on Windows Servers with intercept-X installed.
I have some general questions about that feature.
Hi Parag,
Thanks for reaching out to the Sophos Community Forum.
Could you elaborate on what sort of tasks you will be performing on the Server using SCCM?
If one process runs on the server to execute a new process, if the new process is not excluded it may not be permitted to run.
I suggest checking out the following articles as well to see if this helps better explain.
- Server Lockdown Frequently Asked Questions
- Server Lockdown known issues
- Applications that need manual Lockdown policy changes
In general Server Lockdown is only recommended for systems which will not require much user-interaction or systems where changes will not be applied very frequently.
Please note, Server Lockdown will no longer work on Server 2012/2012 R2 after October 10th 2023. Protection on these OS' will require you to have an extended support license, however, Server Lockdown will no longer be available on these OS'.
Hi Parag,
Thanks for reaching out to the Sophos Community Forum.
Could you elaborate on what sort of tasks you will be performing on the Server using SCCM?
If one process runs on the server to execute a new process, if the new process is not excluded it may not be permitted to run.
I suggest checking out the following articles as well to see if this helps better explain.
- Server Lockdown Frequently Asked Questions
- Server Lockdown known issues
- Applications that need manual Lockdown policy changes
In general Server Lockdown is only recommended for systems which will not require much user-interaction or systems where changes will not be applied very frequently.
Please note, Server Lockdown will no longer work on Server 2012/2012 R2 after October 10th 2023. Protection on these OS' will require you to have an extended support license, however, Server Lockdown will no longer be available on these OS'.
An OS upgrade would cause the sytem to undergo significant changes. Server Lockdown is not intended for such systems. While some minor Windows Updates may succeed, any significant changes may require you to unlock the system prior to upgrading.
I suggest also checking Steps required if doing a Windows Update before locking a server.
