AV will turn itself on

Need to disable the anti virus functions so I turn off antivirus, auto-containment,virus scope for 1 hour.
I get prompted for the administrator credentials to do so.
But it will turn itself on with minutes.

So have to uninstall the AV to get the task done.

Why isnt it staying turned off?
We see this all the time.
Customers are asking to have it replaced.

I know with past versions of the rmm or ccs you have to disable from console but I believe recently with the new version when I disabled the firewall or auto-containment at the endpoint level it stayed disable for the time I set it too.

When the console communicates with the endpoint it will turn the module back on regardless of the time length set locally. The workaround is to also disable the ITSM service but that will disable Itarian Remote Control until switched back on.

I have turned off from endpoints and seems to behave just like it should, usually short timeframes however 15 mins just to install or run something as a one off.

If I have a 3rd party provider needing extended access, then we arrange a time frame and I disable from the console/online and turn back on when needed.
It is generally just the auto containment and perhaps the firewall every now and again.

mcfproservices

Hello @smartcloud ,

Are you trying to disable AV directly from endpoint? If so, please make sure that you enable “Enable local user to override profile configuration” on "Profiles ->{profile} -> Client Access Control section. Otherwise local changes will be overriden on next synchronization.

Best regards,
Ilgaz

[QUOTE=ilgazy;n57142]Hello @smartcloud ,

Are you trying to disable AV directly from endpoint? If so, please make sure that you enable “Enable local user to override profile configuration” on "Profiles ->{profile} -> Client Access Control section. Otherwise local changes will be overriden on next synchronization.

QUOTE]

My first reaction was yes, its enabled but I did a check.
Yes, it is on some and No its not all others.
Thats why we had such a mixed result.
I went over all profiles and enabled it.
Will wait a few minutes before I check, but I m sure thats the reason.
I must have cloned profiles with it on and with it off.

Thank you for your response.