Differ from Policy

Hello Joetobai,

why it affected the specific policy but not other policies

you mean it affected all the clients using one of the AV&HIPS policies? Or else? Has the policy been changed recently?

Christian

Hi Christan,

Yeah all the clients using the policy in question, there has been no changes to policy recently which is why I'm wondering.

Thanks

Hello Joetobai,

hm, strange - unless the endpoints have something in common apart from the AV policy. There's a number of potential causes but most of them wouldn't explain why (seemingly) only endpoints using a specific policy are affected. You did already make them comply, didn't you? If a Differs from policy doesn't go away (or you are otherwise interested in the reason) verbose logging for the Agent might give some insight.

Christian

No changes to the policy so I cant understand why this would happen, when I select workstations & set to comply it works fine. Is there way to know when changes were made to a policy

If you are running SEC  5.2 onwards and you have Auditing enabled you can see the policy history.

http://www.sophos.com/en-us/medialibrary/PDFs/documentation/sec_52_auditeng.pdf

8.4 Create a report containing policy changes in an XML format.

As QC says, agent level 2 logging is the only way to relaly know why the client is reporting differs from policy.

Regards,

Jak