All clients are running Symantec Endpoint Protection 11 MR4 and the policies on the SEP server have not been changed. Virus definitions are coming down fine, admin scans are running, it’s just the users can’t start a scan manually.

What caused it?

Well,  I decided a couple of weeks ago to set my GPO to ensure that all of the Symantec services could not be stopped by our users, which are Power Users to their local workstations. I simply Enabled the policy and set the services to Automatic. Obviously, it was doing something more to one or more of the services. Once I went back into the GPO, disabled those settings, and let AD replicate out, the users were able to once again initiate virus scans.

1. Open your Group Policy and go to Computer Configuration | Windows Settings | Security Settings | System Services.
2. Right click the service that you want to control and select Properties as seen in Figure A.

Figure A:

3. Place a check mark at ‘Define this policy setting‘. Immediately the Security dialog will be displayed.

What you do from here depends on what you want to accomplish. If you want to prevent a user in the local Power User group from stopping a service, simply click OK. This will take away the Power Users group rights from the service.

If you want to allow a user or group to be able to start and stop the service, then add them to the Security list and click OK.

4. Select the service startup mode and click OK.

That’s it. Give the policy time to replicate and you now have complete control over the specified service on all of your workstations.