Software Restriction Policies and Symantec Antivirus

[Guest Jose]

Hello,

 

I recently implemented SRPs in my Windows network, thoroughly testing many

things before deployment. So, after deploying SRPs everything works fine:

allowed programs start, disallowed programs don't.

 

However, I have problem with Symantec AntiVirus 10.x clients - they appear

like their Auto Protect is disabled (SAV yellow shield icon is in red

circle), but SAV client software itself is running, i.e. I see yellow shield

icon in the task tray, I can double click it, SAV client opens, I can run

scans etc etc. Before deploying SRPs SAV worked fine without trouble.

 

SRPs config is set to default, appart from that I am exclusively allowing to

run all programs in C:\Program Files\ and C:\Windows\ directories by path

rule (+some additional path rules for network servers with startup scripts

and software install distribution point).

 

SAV is installed in C:\Program Files\. All SAV services, that are set to

start automatically, are started. Event viewer shows nothing unusual, no SAV

or other software error messages.

 

I suspect that I need additional SRP registry path rules for SAV, but

walking through registry in search for "Symantec" gave me no clue.

 

So, maybe somebody already was dealing with this problem and could give me a

suggestion where to start from? ;)