Am 10.03.2017 um 17:24 schrieb Klaus Hartnegg:
Many computers here suddenly have UAC off, and my research points to Sophos installer/updater as culprit: UAC stays on when rebooting normally, but reproducably switches to off after a reboot that followed an install, uninstall, or larger update of Sophos. Maybe it only happens if SRP is turned on. I will continue testing on Monday, but maybe others already know more??
Today I reproduced this on another PC, in an almost fresh install of Win7 enterprise (only MS-Office and the updates for Windows and Office were already installed):
As soon as I install Sophos, wait until it is up to date, and then reboot, UAC is off.
If I turn UAC back on, then uninstall Sophos Antivirus and reboot, UAC is off again. Uninstalling the other components of Sophos does not disable UAC. Probably auto-install of larger Sophos-upgrades also disables UAC.
Also interesting: When I enable the group policy "Admin Approval Mode for the Built-in Administrator account", then the Sophos installer (SophosEndpoint.exe) does not change UAC. But then it also does not install the Antivirus component, only the other components (AutoUpdate, Endpoint Defense, Network Threat Protection, and System Protection).
On Wednesday I can try in a Win7 with definitely nothing else ever installed or configured except Windows updates. I hope that our computer center can also reproduce this, and then opens a support ticket with Sophos.
