So I have a weird one.
One of my client's offices is using managed clients of SEP 12.
When you click View Logs in the SEP interface of the client version, two of the users PCs only show logs from the past 14 days.
The PC accounts that these two users use are admin accounts.
If you click Change Settings in the SEP interface, they can manually change the Log Retention period, but it reverts back to 14 days after a PC reboot.
The other users are showing logs from the past year.
The PC accounts that these other users use are non-admin accounts.
They cannot click Change Settings in the SEP interface, that function has been locked by the administrator.
On the SEP management server, the policy settings for log retention is 14 days.
I changed the policy settings on SEPM to be 365 days for log retention, but if this doesn't work for keeping logs in the interface past 14 days, I am out of ideas.
I know the lifetime logs can still be found in the SEP installation folder, but my users use the Export Logs function to send the scan logs to their IT security team in their overseas headquarters.
Any suggestions?