none
SCEP - Removing previously "Allowed Items" RRS feed

  • Question

  • In the Admin console, a test virus was allowed via the "Allow this Threat" option.

    This then will display at the client in the "Allowed Items" under History.

    There isn't any way that I'm able to find to REMOVE this settings once allowed.  Right click options on the individual threat include; Allow this threat, Restore Files Quarantined by this threat, View Infected Clients, and Malware Detail.

    There is no option to NO LONGER ALLOW?

    Thanks in advance.


    Jay D

    Wednesday, October 16, 2013 4:56 PM

Answers

  • Further digging revealed the items previously allowed under "Client Operations".  This wasn't really very intuitive at all... regardless.

    Monitoring \ Client Operations

    Under Operation Name, find the "Allow Threat", verify the collection, then right click on it and delete.

    I'd expect it to be gone from the allowed items on the client under history tab after next SCEP policy refresh.


    Jay D

    • Marked as answer by Jason Deary Wednesday, October 16, 2013 5:09 PM
    Wednesday, October 16, 2013 5:09 PM

All replies

  • Further digging revealed the items previously allowed under "Client Operations".  This wasn't really very intuitive at all... regardless.

    Monitoring \ Client Operations

    Under Operation Name, find the "Allow Threat", verify the collection, then right click on it and delete.

    I'd expect it to be gone from the allowed items on the client under history tab after next SCEP policy refresh.


    Jay D

    • Marked as answer by Jason Deary Wednesday, October 16, 2013 5:09 PM
    Wednesday, October 16, 2013 5:09 PM
  • As this is the only page I found trying to find this out, thought I'd add in newer versions of SCCM this is now much more intuitively housed inside the Antimalware Policies

    Assets & Compliance > Endpoint Protection > Antimalware Policies

    Under "Threat Overrides"

    Been so long since I'd been in there I'd forgot it was there.

    Tuesday, January 16, 2018 10:10 AM