symantec endpoint protection windows 10 1909

Make collection in SCCM to contain all PCs with SEP installed

SEP is interfering with Defender trying to access reg keys tied to services.

I plan on testing the solution tomorrow and will update my findings. What I eventually did was remove SEP and reboot and THEN apply the defender policies in SCCM. In my case I had uninstalled the SEP client but not rebooted before the defender policies tried to apply and it locked up the agent. I finally made it to some of the threads you have posted above. Then I noticed a number of computers that hadn't reported inventory in SCCM for a while. What was supposed to happen is that when SEP was removed Defender would kick on and use it's policies which is exactly what I saw in testing. Everything seemed to be working fine because SEP is set to keep Defender off so the policies didn't do anything.

So we enabled the Defender management in SCCM and let the policies go out. I am having this exact problem and have come to a similar conclusion! Our situation is that we are moving away from SEP and currently our only option is Defender.

Symantec endpoint protection windows 10 1909