Unauthorized uninstall protection functionality regression from FSAV PSB 12.01 build 283 to 293?

Options
etomcat
etomcat W/ Alumni Posts: 1,172 Firewall Master
in WithSecure Elements Endpoint Protection

Dear Sirs ,

I wonder if you have heard of a similar situation: it appears that "anti-virus software removal prevention" functionality doesn't work in the latest bugfixed edition of FSAV PSB WKS 12.01 on the Windows 10 64-bit Enterprise Edition platform?

FSAV PSB WKS 12.01 build 283 (tow-hundred eighty three) works properly: when trying to uninstall it using the "Add / Remove Programs" icon in Windows's Control Panel, a warning message appears stating that "Current policy settings prevent removal of this product".

FSAV PSB WKS 12.01 build 293 (two-hundred ninety three) fails the test: any local user with just local-admin rights can uninstall it using the "Add / Remove Programs" icon. There is no blocking message displayed, there is no request to enter a special password or PIN code for uninstallation authorization, the secrity suite product is simply removed.

The corresponding profile in PSB EMEA webportal has been confirmed as correctly configured and does apply to all of the partiular computers involved in this problem. Thus is it possible to state that PSB WKS 12.01 b293 has a bug?

 

Thanks in advance, Yours Sincerely:
Tamas Feher, Hungary.

Comments

  • Vad
    Vad W/ Alumni Posts: 1,069 Cybercrime Crusader
    Options

    Hello Tamas,

     

    I've checked the uninstall protection functionality on PSB WKS 12.01.293, and it works for me.

    Please, try to check the value of policy 1.3.6.1.4.1.2213.11.1.13.11 on problematic machine. It should be "2" if the protection is enabled.

    You can find this info in policy.txt file in collected fsdiag.

     

    Best regards,

    Vad

This discussion has been closed.

Categories