SEDR withdraws private cloud policy from all SEPM groups when transitioning from MyCompany only to managing specific groups

Products

• Endpoint Detection and Response
• Advanced Threat Protection Platform

Issue/Introduction

Symantec Endpoint Detection and Response (SEDR) 4.x withdraws private cloud policy from all SEPM groups when transitioning from MyCompany only to managing specific groups

No visible error.

Steps to Reproduce:
1. In SEDR1, configure SEPM controller with group inclusion enabled, add only
'My Company\GroupA' in the inclusion list. Save SEPM controller
2. In SEDR2, configure SEPM controller with group inclusion TURNED OFF. In
the SEP Policies dialog, make sure the 3rd checkbox to apply policy to all non-
default groups is UNCHECKED. Save SEPM controller.
3. On SEPM, under 'My Company\GroupA' > External Communications > Private
Cloud Policy, make sure it points to SEDR1
4. On SEPM, under 'My Company' > External Communications > Private Cloud
Policy, make sure it points to SEDR2
5. On SEPM, under 'My Company\GroupB' > External Communications > Private
Cloud Policy, make sure the policy is disabled.
6. On SEDR2, edit SEPM controller > Group Inclusion > Add 'My Company\GroupB'
in the inclusion list.

Expected Results:
1. On SEPM, under 'My Company\GroupA' > External Communications > Private
Cloud Policy should point to SEDR1
2. On SEPM, under 'My Company\GroupB' > External Communications > Private
Cloud Policy should point to SEDR2

Actual Results:
1. On SEPM, under 'My Company\GroupA' > External Communications > Private
Cloud Policy is disabled
2. On SEPM, under 'My Company\GroupB' > External Communications > Private
Cloud Policy correctly points to SEDR2 as expected

Environment

Setup:

SEDR1, SEDR2
SEPM with group structure as:

• My Company
• My Company\Default (inherited)
• My Company\GroupA (independent)
• My Company\GroupB (independent)

Resolution

Please upgrade to Symantec Endpoint Detection and Response (SEDR) 4.3.