HI everyone, still trying to get the hang of this product so please bare with me if my vocabulary isn't up to speed. This is for Symantec Endpoint Protection 12.1
We want to block Facebook and other social networking sites by default on most computers and have a few select machines that are allowed to access them, but only when certain users are signed in.
I’ve already succeeded in blocking sites and assigning a few machines to a new group with full access, and if that’s as granular as it gets, so be it, but it’s not ideal for our needs.
To that end, I've got 3 groups:
- Default (FB and other sites will be blocked)
- Computers in user mode (FB blocked by default, but set in user mode)
- Excepted Users
I've got 2 firewall policies:
- Firewall Policy (Default, assigned to Default and Computers in user mode groups
- Facebook-Allow (Explicitly allows facebook and is assigned to the Excepted Users group)
My Assumption was that when most users logged into a Computers in user mode group machine, it would default to the Firewall Policy and block FB. But when a member of the Excepted Users group logged into a Computer in use mode group machine, it would apply the Facebook-Allow policy and allow them to access FB and other restricted sites.
Can someone explain where I'm going wrong here and how to get this set up properly?
Also, I noticed there are some logging options for the firewall rules, where can those logs be viewed?