Alex navigated past the service account credentials, bypassed the tamper-protection warning, and dove into the folder. There they were: SAV64.msi , RTVScan.exe , and the holy grail— SymantecEndpointUnmanagedClient.zip . A time-stamped relic from the last major version update.
Uncheck the box that says "Participate in Symantec Endpoint Detection and Response" and ensure you select "Unmanaged" or a group that does not enforce server communication. bypassed the tamper-protection warning