Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 9 replies
  • Subscribers 2 subscribers
  • Views 9259 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Differs from policy - Anti-Virus and HIPS policy

keystroke13

I have a handful (2%) of machines that will not comply with the Anti-Virus and HIPS policy. I followed all aspects of Article ID: 113070 without resolution. I've enabled verbose logging, however I'm not entire sure what I'm looking for. I noticed that a few machines do not thave the Sophos scheduled scan task in the C:\Windows\Tasks directory. I have also removed the SAUPolicy file, contacted support which keeps referring me to the aforementioned article, and forum post "Differs from policy" dated 2009.

Aside from running the Sophos Diagnostic Utility (SDU) and submitting it to support (again) does anyone on the forums have any suggestions? Would posting a lastest RMS log file help diagnose the problem?

:27661


This thread was automatically locked due to age.
Parents
  • 0

    Doubt it's RMS - it's correctly ("successfully") reporting that it is indeed differing.

    If I was doing it myself (not the best test because several things are all changing at once)...

    1. Ensure the user SYSTEM and group 'administrators' have full control of:
      • C:\Windows\Tasks\
      • C:\Windows\System32\Tasks\
    2. Delete the Crypto keys (again).
    3. Reboot immediately afterwards - important.
    4. Force a comply of the policy to the server when it's up again (with a scheduled scan configured).

    If the policy still differs (and based on a quick scan of case history where the problem was found to be related to scheduled scans) you should remove/disable all group policies that are applied and force comply again.  If that works it's something in the GPO and the next steps then are to switch the GPOs back on one by one and see what affects it.

    Hope it helps.

    :27677

     - - - - - - - - - - - -

    Communities Moderator, SOPHOS
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Reply
  • 0

    Doubt it's RMS - it's correctly ("successfully") reporting that it is indeed differing.

    If I was doing it myself (not the best test because several things are all changing at once)...

    1. Ensure the user SYSTEM and group 'administrators' have full control of:
      • C:\Windows\Tasks\
      • C:\Windows\System32\Tasks\
    2. Delete the Crypto keys (again).
    3. Reboot immediately afterwards - important.
    4. Force a comply of the policy to the server when it's up again (with a scheduled scan configured).

    If the policy still differs (and based on a quick scan of case history where the problem was found to be related to scheduled scans) you should remove/disable all group policies that are applied and force comply again.  If that works it's something in the GPO and the next steps then are to switch the GPOs back on one by one and see what affects it.

    Hope it helps.

    :27677

     - - - - - - - - - - - -

    Communities Moderator, SOPHOS
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Children
No Data
Unfiltered HTML