Remote Access Protection

Note: Please do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

Issue abstract:

Detailed description: On reviewing Security History this morning I have found an event “Remote Access Protection Disabled” and it is listed as high risk. However in Advanced Security Intrusion Prevention is turned on and there are no connection attempts listed. This is the fourth time this has appeared over the last week.

Can anyone suggest (as simply as possible because my understanding of computers is minimal) what is going on here and what, if anything needs to be done about it?

Product & version number:

OS details:

What is the error message you are seeing?

If you have any supporting screenshots, please add them:

Hello @Pat122

Product & version number:
OS details:

Does Norton 360 LiveUpdate & QuickScan run okay?
Please run Norton LiveUpdate + Restart (not Shut down) machine.

fwiw ~ as test:

1 Like

Hi bjm, thanks for the reply.

Live update and Quick Scan are fine. Intrusion Prevention is on and there have been no incoming Remote Desktop Connection requests. Have updated and restarted and so far everything is fine.

1 Like

Hey there, I’ve noticed the same thing on my side. I’m guessing it’s actually a bug or a simply action taken by any PC at the moment it start shutting down.

Basically i noticed it the next day after turning my PC on and check the security history. i had the exact same message as you which did freak me out a little making me think i was maybe hacked.

However after looking into the time stamp of it, i realized that this security log happened around the same time i turned the PC off, knowing that i have to take a few medication for health issues around the same time every day, and i did it around also at that time, i quickly downed to me that, this was maybe happening while the PC is shutting down.

So i tried, i rebooted the PC and again the same log happened, i tried then to shut it down and a few seconds after turn it on agains… and there i was again, a new log like this.

My opinion is, that depending on your Hardware, how fast it can go basically, Norton as everything starts shutting down, is still able to write a log at the very last second before everything goes off… maybe I’m totally wrong tough, but on my logs this happened every time about 1 sec after i click on “shut down” button (i did it many times it’s really about 1 second). However it also does sometimes writes absolutely nothing to me (maybe due to a small latency on the memory or perhaps sometimes the system manages to go a bit quicker enough for the log to no happen?),

I don’t know but still i would really appreciate if any knows if it’s just as i said or it’s a bug … or worse ?

All: As a precaution check for the setting below being enabled on your OS. This is from my daily duster Windows 10 Pro PC: Noted - I don’t see any entries on my machines, Windows 10 / 11 during shutdown or restart where the issues presented is logged.

SA

I’ll check see if this option is enabled, but i doubt. I’ve verified for any suspicious connections and nothing was out of ordinary. I even went to the extend of completely wiping out clean the drive and reinstalling everything from 0. And it still shows from time to time the same security log whenever i shut down the PC.

Maybe a OS or hardware difference i have no clues but if even after a clean reinstall it’s still doing it. It’s not all the time but really sometimes no and other times yes. And as always only when the PC is shutting off. Also verify your logs for the whole extend not only the “recent” logs if anyone has their PC network setting on Public, Norton bombards the security log with a bunch of information of it blocking local networking In/Out for your machine and completely bury any other security log i think it happens every few minutes. This only happens if your setting is as public network if you switch to private then it stops

Thanks guys.

On mine the remote access is off and I don’t think the Remote Access being Disabled was necessarily happening when I shut the computer down.

Good for you dude, mine really does sometimes disable itself when im shutting down the pc. But when i turn it back on, it’s enabled again when i go check it. I do worry a little of course , i mean whi wouldn’t…but so far i can’t seem to find any issues there’s also nothing into NETPLWIZ of weird accounts, also no new firewall rules for any strange progran that i don’t recognize… i mean i even wiped the driver clean and even flashed the bios of my MOBO before reinstalling windows 11 once again… other than that if its too much technical i have no idea what to do… so i pray its a bug… Anyone here knows how i could contact Norton support? I live in EU by the way

alright, now that i made back home from work, i went to check for the Remote Desktop option on Windows settings and… well i have the Home edition of Windows 11, so i don’t even have Remote Desktop by Default installed :rofl:
So i guess i’m safe… But as i said, it only happens right after really not even a full second after i clikc on the Shut Down button, and also it sometimes doesn’t even happen, so far this is the only thing getting kinda on my nerves but, after going around the many post there’s in here of this new update ith this ne interface, i’m guessing Norton folks must VERY busy. there’s tons of people report on many bugs from everywhere. Basically it feels more like a bug than anything. I don’t have any new port open or any ne Firewall rule, i mean it persisted even after full Drive wipe with a flashed BIOS :joy:

To be honest i’ll just keep surveying it a little, right now the only thing really bothering me is that i forgot to back up my taxes from this year… so when i’ll have to report for next years i’ll have a hellish amount of work to do :pensive:

Hello @Ran

I also have some instances of the “Remote Access Protection disabled” appearing in Security History. In some cases it is, similarly to you, timestamped just after I choose to shut down the computer. I do have some other cases where it does not occur as shutting down. But in those cases the warning is always followed within a few minutes by a “Remote Access Protection enabled” entry. So, while perhaps confusing, this doesn’t seem too worrisome…although I guess it’s always possible an attack could occur even during that very brief “off” period.

BTW, I also have a similar situation with Security History warnings of “Intrusion Signatures Disabled.” Again, that is logged either just as I am shutting down OR is followed within a minute or two by and “Intrusion Signatures Enabled” entry.

EDIT: Why is the forum telling me my post is from 25 Oct when it’s actually 24 Dec, 2024?