In Protect, when a Alert Auto-Resolves or just Resolves, what does that mean. Did a file get quarantined? Is the file/program blocked but still on the device? Did it get deleted? Do we know?
Page 1 / 1
Yes, the file gets quarantined inside this directory:
Library/Application Support/JamfProtect/Quarantine/<EVENT_UUID>
and also, the permissions are modified to strip off the execute permissions off the item before it gets moved to the quarantine
Thank you!
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.