How to Investigate a Sudden Disablement of Endpoint Security Policies

A policy may be disabled by an approved change, misconfiguration, agent failure, or unauthorized administrative action.

Checks to make

Check policy audit history, actor and approval, affected device scope, agent status, and related identity events. Restore protection using controlled change procedures and monitor for repeated policy changes.

When to get help

Security operations can investigate policy changes and coverage gaps. Informatix Systems can assess the symptoms, evidence, and next steps. Contact Informatix Systems to discuss this issue.