Quarantine option doesn't exist in SEPM

Products

• Endpoint Detection and Response

Issue/Introduction

I used to see options in SEPM after integration with EDR to place or remove endpoint from quarantine, but I don't see them any more. 

Environment

Steps to reproduce:

1. In SEPM 14.3 RU1, right click on an Online SEP client which is enrolled with EDR 4.4 or 4.5.
2. On the menu that appears, highlight "Run command on computers"
   
   Expected results: options for Restore and either Isolate or Quarantine appear in the list.
   
   Actual results: next level menu does not contain option to "Restore", "Isolate", or "Quarantine" the endpoint for network traffic.

 

 

Cause

These commands don't appear by default in the SEPM.  They are only available if you enable the Deception feature in the SEPM.

Resolution

1. With a text editor, open SEPM_Install\tomcat\etc\conf.properties, where SEPM_Install is the installation folder for SEPM.
2. Add the following line: scm.deception.enabled=true
3. Save and close the file.
4. Open services.msc and restart the SEPM services 

 

Additional Information