During my test with ESM 3.0 I had one machine where the CIS client would go rogue and lock down the computer with the behavior monitor. The ESM showed the client as compliant with the policy (behavior shield disabled) but even when I went and put my hands on the machine to manually disable the behavior protection permanently it would re-enable itself. I tried applying a few different policies to that machine but the problem remained. Sorry I can’t help you troubleshoot further, I installed another centrally managed AV solution.
Hi,
Was our business and enterprise support able to assist you with this?
Kind regards,
Michel.