Symantec Endpoint Firewall and Antivirus is blocked out by Microsoft endpoint

[Arild Carlsen]

IHAC with the following problem. Some (not all) windows 10 clients lost control over firewall and antivirus from Symantec endpoint to Microsoft endpoint.

Symantec/Microsoft version installed is : 14.3 RU6/ 14.3.9203.6000 and Microsoft Windows 10 Enterprise x64 Build 19045.

For some reason the Symantec software is blocked from taking control over the Firewall and AntiVirus settings in Windows.
Current user is not local administrator and is not able to revert back to Symantec.

I suspect this is because of GPO settings that somehow forces Symantec to loose control. I did not expect this to be an actual conflict with the Symantec Endpoint.  Hence we have to duplicate firewall settings from Symantec policies into Windows GPO settings. 

Has anyone experienced this issue with Symantec endpoint clients loosing control to Microsoft Endpoint?

Any ideas are appreciated.

[Imtiaz Hussain]

Hi Arild,
We cannot run two AV at the same time so when you install symantec , it disable defender policies

[Torsten Knorr]

In Windows 10, you run 22H2, SEP needs to register over the Security Center, so the WSC Service needs to do this.

The WSC has a dependency to the Symantec ELAM driver, so check, if SymELAM is activated over the SEP Policy and then check again if this helps.

If SEP registers to the WSC, the defender AP Mode will be disabled and SEP take control over AV & firewall.

If there is any setting within a GPO to modify behavior of Defender, you should revert it to default.

[Arild Carlsen]

Thanks for replying to this discussion.

Torsten, I think you guided me to the right solution.

A GPO mistake blocked out the client from connecting to domain network, through our Always on VPN solution. 

This happened after Windows update restart, when laptop was outside the normal domain network.
The windows update interferred with the network settings and reversed firewall control to Windows defender and thereby activated the wrong GPO settings.

I had to bring laptop inside windows domain network and GPO settings back to default for Private/Public settings.

Then a reinstall of Symantec agent on the client laptop swithed the control of Firewall and Antivirus back to Symantec.

Arild Carlsen