Some Symantec Endpoint Protection (SEP) client switch automatically from "Computer mode" to "User mode"
SEP clients which were installed as "Computer mode" are working now as "User mode".
An issue with client registration has been identified as one possible root cause.
For additional information on user mode and computer mode, please see the Related Articles referenced below.
This specific issue has been addressed in Symantec Endpoint Protection MR4. Please upgrade to to the latest version of Symantec Endpoint Protection to address this issue.
Title: 'Release notes for Symantec Endpoint Protection 11.0.x and Symantec Network Access Control 11.0.x'
Symantec Endpoint Protection clients register with Symantec Endpoint Protection Manager in User mode instead of Computer Mode.
Fix ID: 1421859
Symptom: Client packages exported with computer mode and a preferred group set appear in the wrong group and in user mode after install.
Solution: That behavior is as designed if installing as a workgroup user, but registration now ensures that it does not accidentally change an entry from computer mode to user mode.