Mac Only Response Rule

[54]

The response rule "Endpoint Prevent: User Cancel" is only supported on Windows.  If a user on a Mac triggers the same policy the traffic is allowed. I cannot find a way to put a condition on RR based on agent OS.  I can't find a "Stop Processing Rules" trigger either.

I am trying to create the following RR's for a single Endpoint policy

1. Endpoint Prevent: User Cancel (Windows)
2. Endpoint Prevent: Notify (Mac)

DeviceID only looks at removable media not the OS.  

Anyone got a clever idea on this one?

------------------------------
If it were easy it would have been done already. -Peter H. Diamandis
------------------------------

[Maveryc]

Why not use two policies, one for Windows and one for Mac?

[54]

That would work if I could figure out how to specify an OS in an endpoint policy.  Any tricks?

------------------------------
If it were easy it would have been done already. -Peter H. Diamandis
------------------------------

[Maveryc]

I don't think you can specify an OS directly in the policy. You could create a policy group specific for MacOS policies and then assign that policy group to a specific server. And then put all the MacOS machines on that server.

This is not an easy solution and would require some effort, but it's the only way I can think of to accomplish what you're trying to do.

[54]

I think you're right.  We are probably going to do this with the next upgrade. 

We did notice one possible trick.

• Windows - User Name = {DOMAIN}\,{DOMAIN2}\,
• Macintosh - User Name = {Last char of asset tag}\{first char of samaccountname} 

It looks ugly but it seems to work.  Just need to let if chug along for a few days to see if there are any gotcha's.

[Krista Rivera]

i agree We are probably going to do this with the next upgrade
Your information is very interesting. Thank you for sharing