Quarantine option doesn't exist in SEPM
search cancel

Quarantine option doesn't exist in SEPM


Article ID: 210841


Updated On:


Endpoint Detection and Response


I used to see options in SEPM after integration with EDR to place or remove endpoint from quarantine, but I don't see them any more. 


Steps to reproduce:

  1. In SEPM 14.3 RU1, right click on an Online SEP client which is enrolled with EDR 4.4 or 4.5.
  2. On the menu that appears, highlight "Run command on computers"

    Expected results: options for Restore and either Isolate or Quarantine appear in the list.

    Actual results: next level menu does not contain option to "Restore", "Isolate", or "Quarantine" the endpoint for network traffic.




These commands don't appear by default in the SEPM.  They are only available if you enable the Deception feature in the SEPM.


  1. With a text editor, open SEPM_Install\tomcat\etc\conf.properties, where SEPM_Install is the installation folder for SEPM.
  2. Add the following line: scm.deception.enabled=true
  3. Save and close the file.
  4. Open services.msc and restart the SEPM services 


Additional Information