GPO Events 1502 generated every 5 minutes after upgrading to 14.3 RU7

Products

• Endpoint Security Complete
• Endpoint Protection

Issue/Introduction

After upgrading to Endpoint Protection (SEP) / Symantec Endpoint Security (SES) 14.3 RU7, you noticed an increase in GPO events 1502 every 5 minutes in Windows Event Viewer:

 

Environment

Release : 14.3 RU7 (build 9689)

Resolution

This issue has been fixed in 14.3 RU8.

• For information on how to upgrade the SES agent, see Upgrading Windows client software automatically (broadcom.com)
• For information on how to obtain the latest build of SEP, see Download Symantec Enterprise Security software, tools, and patches (broadcom.com)

Workaround (Cloud):SES

1. Edit the Malware Protection Policy
2. Under the Advanced Settings, expand the options by clicking Show Advanced to the right of Enable Auto-Protect
3. Enable the option Let the Symantec Agent coexist with Windows Defender

Workaround (On-Prem):SEP

1. Edit the Virus and Spyware Protection Policy
2. Select Miscellaneous
3. Check the option Coexist with Windows Defender

Note: Clients will get the updated policy based on the Heartbeat.

 

Let the Symantec Agent coexist with Windows Defender

• Supported starting with agent version 14.3 RU7.
• Enable this option to let Windows Defender run before Auto-Protect runs. The option is off by default.

Note: Enabling this option delays Auto-Protect detections. Disable the option if Windows Defender is disabled on your devices.