not fully tamper protected

rino19ny,

Did a little testing in the last couple of days.  Removing the user accounts from Sophos Administrators and moving them to Sophos Power Users removes most control from the user.  Right Click scan and Authorize are still available, but as mentioned are probably best left open.  If a user adds an authorization, you'll know about it.  The central console will give you a notification that the client isn't complying with policy.  You can then override that user's authorization if you wish by forcing their client back into compliance.  It also will alert you to software that might be false flagged that is giving your users issues. 

The Power User group at least stops your casual user that knows how to open a GUI and stop an A/V from running.  It still doesn't stop the "closet techs" that know to stop services and kill processes, but it's better than leaving everyone as Sophos Administrators.

I agree that the more perfect solution is education (and good acceptable use policies that are strongly enforced), and it shouldn't be IT vs everyone else.  The reality of any corporate environment though, is you will always have those users that either think they know how to run their system better or want to subvert the policy enforcement to surf their NSFW content.  The more tools available to rein in those rogue users the better.

rino19ny,

Did a little testing in the last couple of days.  Removing the user accounts from Sophos Administrators and moving them to Sophos Power Users removes most control from the user.  Right Click scan and Authorize are still available, but as mentioned are probably best left open.  If a user adds an authorization, you'll know about it.  The central console will give you a notification that the client isn't complying with policy.  You can then override that user's authorization if you wish by forcing their client back into compliance.  It also will alert you to software that might be false flagged that is giving your users issues. 

The Power User group at least stops your casual user that knows how to open a GUI and stop an A/V from running.  It still doesn't stop the "closet techs" that know to stop services and kill processes, but it's better than leaving everyone as Sophos Administrators.

I agree that the more perfect solution is education (and good acceptable use policies that are strongly enforced), and it shouldn't be IT vs everyone else.  The reality of any corporate environment though, is you will always have those users that either think they know how to run their system better or want to subvert the policy enforcement to surf their NSFW content.  The more tools available to rein in those rogue users the better.