A handful of our clients need to run SEP in an unmanaged state because they rarely, if ever, connect back to our network. I set up an install using the MSI and I use the property SYMREBOOT=ReallySuppress but the client still restarts after the install. I believe it is the symantec software itself and not the installer which initiates the restart because of what I found n the event viewer (below). This unexpected restart is throwing our Operating System Deployment procedure into an error state. (We use Microsoft SCCM).
Here is a snippet from the System event log:
Event 1074
Source User32
Detail:
The process C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.0.1904.0000.105\Bin\ccSvcHst.exe (COMPUTERNAME) has initiated the restart of computer COMPUTERNAME on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown
Reason Code: 0x80070000
Shutdown Type: restart
Comment: