File not quarantined

[kostasthedelegate]

Hello, 

I have the below

The policy is quarantine, but the event says it does not block it.

Any idea why?

Thanks and regards, 

Konstantinos

[Matthew Franks]

You said it is in Protect Mode, but the event says it is in Audit mode.  Please check your policy settings.

Thanks,

Matt

[kostasthedelegate]

The dcagentservice.exe is whitelisted by the user, maybe that is why it is running, as a child process and it says audit?

The policy is in quarantine mode