When does the Symantec Endpoint Protection client switch to user mode?

Products

• Endpoint Protection

Issue/Introduction

The Symantec Endpoint Protection Manager (SEPM) console displays Symantec Endpoint Protection (SEP) clients in user mode.  These clients had previously been in Computer Mode.

Resolution

The Symantec Endpoint Protection client uses user mode when either of the following is true:

• The SEP client, upon registering with the Symantec Endpoint Protection Manager (SEPM), is not already listed within the SEPM's database and the client's Preferred Mode is set to user mode (see below). The client will then register in user mode and will remain in user mode unless changed by the SEPM administrator.
  • Note: Conversely, once the client is a computer mode client in the SEPM, it will always be a computer mode client unless the client is removed from SEPM or the administrator manually switches the client from computer mode to user mode using the SEPM's user interface.
• There is already a user mode entry for this client in SEPM when the SEP clients registers with the SEPM. In this situation, the client will ignore what its Preferred Mode is set to and will use what the SEPM tells it to use.

"Preferred Mode" is represented by the following registry value “PreferredMode” located in the following registry KEY on a SEP client machine:

•  HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink

PreferredMode=1 – SEP client has been installed in Computer mode.

PreferredMode=0 – SEP client has been installed in User mode.

 

Note: To change the PreferredMode value you must edit it manually in the registry. This value does NOT get updated if you change the client mode from the SEPM.