Symantec Management Platform (Notification Server)

Hello All,

How I can protect the Altiris Agent from the local Admins of a machine shutdown the service and kill the process?

I have configured a GPO to deny access to the service and this is working but when I go to the Task Manager I can kill the process of Altiris Agent.

I have configured the protection in the folder of Altiris Agent as the article describe in the link below:
http://www.symantec.com/connect/articles/folder-security-reinforcement-using-cms-only

After setup this the local admin still can shutdown/kill the process.

Anyone has an ideia to effective protect the Agent?

Thanks!

the only other option is to invest in a tool like Symantec Endpoint Protection, that will allow you to setup tamper protection policies. Or, you can start tracking people down who violate your policies, and establish some sort of enforcement.

First, find out who is killing the agent.  Second, find out why.  We had a user in our own department one door down who was killing the agent because he perceived it to be slowing down his PC.  It wasn't, but we were able to explain what it does, why it's important.  If he would have kept disabling the agent, we would have brought it to his manager's attention.

There's a reason of some kind that the users disable the agent.  See if there's anything you can do to address root cause.