I recently installed Endpoint Protection (14) on an office network and within a week 3 desktops suffered catastrophic failures in a complete loss of their Email boxes -- all data completely gone. The users have Thunderbird Email and what happens, apparently, is EP detects a virus in the file and since it doesn't know how to manipulate a Thunderbird email box it essentially quarantines the entire email box, yet when you go to the control panel and attempt to restore the quarantined file, EP can't do it. Not from the client, not from the server. Even Symantec Technical Support, escalated 3 levels, can't restore the file.
After escalating this to the highest level on the continent, I am told that "yes, EP 14 does not know how to manipulate a Thunderbird mailbox and so yes, this patern of catastrophic damage is know to us and our 'best practices' document tells you to add exceptions for your email boxes. We have special hooks for Outlook but we know that we can't handle Thunderbird."
I'm puzzled by two things:
First, if Symantec knows that this is a problem with their software, why don't they fix their software?
Second, if Symantc knows that this is a problem and they can't or won't fix the problem, why doesn't their software come configured as default to skip the files it knows it can't manipulate?
I feel like I was shipped a box that contained a burning fuse and I'm being told that it was my fault for not expecting that and dousing the fuse before installation.
That said, I did run into a large number of technicians that told me that they've never before in history ever even once experienced any kind of problem of any sort with Endpoint Protection ... so maybe the problem is that the problem never passed the tech support/engineering barrier.