This content has been marked as final. Show 5 replies
Well, I think I found my answer on the McAfee knowledgebase. Acticle KB41896
It states that you can't get alerted when a user manually disables the OAS. The "On-Access Scanner is disabled" selection under the notification rules is for a malfunction/threat. That explains why it did not send an alert when I manually disabled the OAS on a test workstation.
Not too sure how to test a malfunction/threat to see if it will send the alert.
kill mcshield from the system services on a remote machine and see if it generates a notification
I have tried to do what you suggested by ending the Mcshield process. I had to modify the access protection rules to allow for mcshield to be removed. This I done using task manager.
It does not seem to send out the alert. Have you managed to get alerts from your EPO 3.6.1 this way? We do get alerts about viruses being detected and users that might uninstall the epo agent etc.
tbh i dont even report on those events (have them filtered out) since all that crud with 8.5 starting and stopping all the time
It was my boss who wanting to find out if we could get those alerts. She has since told me not to pursue it any more.