Enabling or disabling Real Time File Integrity Monitoring (RTFIM) for the Windows Data Center Security Agent (DCS)

Products

• Data Center Security Server Advanced

Issue/Introduction

This article is for enabling and disabling Realtime File Monitoring for Windows servers

Current online documentation is incorrect. Windows servers don't recognize the -rtfim flag. Currently we are working on changing the documentation

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/data-center-security-(dcs)/6-9-2/configuring-v127944871-d3608e167568/enabling-the-real-time-file-integrity-monitoring-f-v127947548-d3608e175301.html 

To enable real-time file integrity monitoring on a Windows computer
On the Windows agent computer, open a command prompt, and run the sisipsconfig.exe -rtfim on
Restart the agent computer to load the real-time file integrity monitoring kernel mode drivers

Resolution

To enable or disable Realtime File Integrity Monitoring you need to edit the Detection Parameters in the Java Console and re-push the policy out to the agent.