Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 9 replies
  • Subscribers 2 subscribers
  • Views 9256 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Differs from policy - Anti-Virus and HIPS policy

keystroke13

I have a handful (2%) of machines that will not comply with the Anti-Virus and HIPS policy. I followed all aspects of Article ID: 113070 without resolution. I've enabled verbose logging, however I'm not entire sure what I'm looking for. I noticed that a few machines do not thave the Sophos scheduled scan task in the C:\Windows\Tasks directory. I have also removed the SAUPolicy file, contacted support which keeps referring me to the aforementioned article, and forum post "Differs from policy" dated 2009.

Aside from running the Sophos Diagnostic Utility (SDU) and submitting it to support (again) does anyone on the forums have any suggestions? Would posting a lastest RMS log file help diagnose the problem?

:27661


This thread was automatically locked due to age.
Parents
  • 0

    So it's definitely the scheduled task.

    Therefore it's back to article 113070 and the section titled 'Check if the schedule task has been created on the client'.  The two servers must be different in some way or other - even only slightly.  As the section suggests maybe a GPO or system restriction - it doesn't take very much.

    Also see the follow-on section titled 'Delete the crypto keys from the local client' if you haven't already done so - but read the warning.

    :27673

     - - - - - - - - - - - -

    Communities Moderator, SOPHOS
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Reply
  • 0

    So it's definitely the scheduled task.

    Therefore it's back to article 113070 and the section titled 'Check if the schedule task has been created on the client'.  The two servers must be different in some way or other - even only slightly.  As the section suggests maybe a GPO or system restriction - it doesn't take very much.

    Also see the follow-on section titled 'Delete the crypto keys from the local client' if you haven't already done so - but read the warning.

    :27673

     - - - - - - - - - - - -

    Communities Moderator, SOPHOS
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Children
No Data
Unfiltered HTML