When AM is running in "Detect Mode"
- Files are scanned
- Found infections are not cured, not blocked, not terminated
- Detections are displayed in client UI, sent to the server and EFR.
"Detect Mode" leaves the PC in a compromised state.
How to enable ?
In order to enable "Detect Mode" on R81 and lower versions:
- Navigate to a policy tab in SmartEndpoint.
- In Anti-Malware policy row find "comment" column.
- Right click a "comment" cell and add the following phrase to a comment: "AM detect mode".
On versions above R81 use procedure from Endpoint Management administration guide.
This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.