We noticed that many systems with a HIPS agent, and active HIPS policies (the IPS policies are enabled and have an active policy applied, but the firewall and application blocking policies are set to 'Off (McAfee Default)', that if you look at the system details of a system, and expand the HIPS section, that the 'HIPSStatus" field is set to 'false'.
Does this mean what it appears to mean, that the HIPS policies are not being applied to this system?
If this is the case, why would it be disabled if it has a HIPS agent and an active policy applied to that OU? And where can that HIPSStatus be changed to 'True'?
Just saw this old post -
Check your IPS Options policy and ensure the optino "Enable host IPS" is enabled. Also, at the Assigned Policies screen for HIPS ensure Enforcement status is set to ENFORCING.