Endpoint Protection/Security agents prior to 14.3 RU5 warn PTP is not functioning when AP is disabled and policy is locked

Products

• Endpoint Protection
• Endpoint Security

Issue/Introduction

The Endpoint Protection/Security agent will display a "Proactive Threat Protection is not functioning correctly" or "Proactive Threat Protection is malfunctioning" in the following scenarios.

Symantec Endpoint Security (cloud)

• The agent version is prior to 14.3 RU5.
• A Malware Protection policy is applied with Auto-Protect disabled and the policy is locked.

 

Symantec Endpoint Protection (on-premise)

• The agent version is prior to 14.3 RU5.
• They are managed by a 14.3 RU5 Symantec Endpoint Protection Manager (SEPM).
• A Virus and Spyware Protection policy is applied to them with Auto-Protect is disabled and locked.

Cause

In 14.3 RU4 and earlier versions, SONAR was dependent on Auto-Protect being enabled.  In 14.3 RU5, SONAR is no longer disabled when Auto-Protect is disabled.  Therefore, when a 14.3 RU4 agent receives a policy to disabled Auto-Protect, SONAR remains enabled, but the client shows a warning message.

Resolution

Upgrade affected SEP/SES Agents to 14.3 RU5.