When the customer enables the Alternative privilege level > Run with Full Privileges on the ips policy. They gets a message "Aborting manual Override because prevention is already disabled" when trying to use the policy override tool to disable the IPS policy.

No error just warning message "Aborting manual Override because prevention is already disabled" on the policy override tool on the agent side.

This behavior is by design as the Policy Override Utility itself is being run in full privilege and the customer has placed the agent Pset into full privilege. The Agent will test to see if prevention is enabled - if the agent is running in full privilege it cannot tell that prevention is enabled.

Applies To

 SCSP 5.2.9 x