Hi,
One of our EndPoint Protection Client has below error messages every few hours. This happend for more than 1 month. Updates seems to be fine with the latest virus defination etc.
System Log > “The latest Revocation Data update failed to load. The component will continue to use its previous content.”
Im currently deploying Symantec DLP and cant find a decent list of exceptions to add in to the local anti virus software. An example path would be \SymantecDLP\Protect\logs\
Does anyone have a good link
Cheers
Fal
People,
I have already built the Windows VM that is joined to the AD domain & running SEP client 12.1.6 MP6.
Since I'm about to create this VM as template, what should I do to ensure that the SEP manager is recognizing that the SEP client is now running from different server name and IP address uniquely ?
Thanks.
Hi All,
Is there any tool currently available to remove legacy SAV 10.0 ..
Thanks in advance
Any love for this tool in 14.0?
It stopped working for me after the upgrade.
Any love for this tool in SEP 14.0? It stopped working for me after the upgrade.
Hi, SEPM has stopped sending logs to Qradar. Where do I go in the console to troubleshoot this issue?
Hello,
Since a few weeks, our backup solutions tells us the following file is in use and cannot be back-up up:
C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11611.sys
Can anyone confirm if this is a legit file from Symantec Endpoint Protection?
Thanks in advance.
Greetings,
Luuk
I have blocked notepad,mspaint and run applications on one location(office) in group.Is it possible to exclude notepad etc in particular machine or user in that location?If so, How?
I have one primary site with management server in Hyderabad and I have installed remote site in Kerala (Integrated with primary site Hyderabad). Now I have created one (Telecom) group and under this group I have created two locations in Hyderabad site (Office vlan 192.168.90.xx and VPN 172.30.250.xx). The telecom group and 2 locations (Office vlan 192.168.90.xx and VPN 172.30.250.xx) are getting replicated in Kerala site.
In kerala site, apart from the above 2 vlans, I have another vlan 172.30.5.xx. I haved added this vlan in Hyderabad site by using OR condition. Now, if i install client in Kerala site from Hyderabad site, the client is directly coming to hyderabad site in Telecom group. Instead I want that to be coming to Kerala site as that vlan is in kerala site.
Please assist
TIA
I had to move my SEPM server to a new subnet. I uninstalled all the Symantec software (I only had 3 clients on this SEPM), rebooted and then reinstalled all the SEPM software. Now, whenever I try to send email with the new config, the server still tries to send it to the old email address.
Symantec support was supportive but can't resolve the problem. We tried using the Manager Config Utitlity and it fails there also. Host files files look OK, etc. Can't find the dang problem.
Several of our Windows 7 Professional PC's, 32-bit are unable to login to Windows after SEP was updated from 12.1.7 to the latest 14 build. Restarting in safe mode and uninstalling SEP resolved the issue.
I have just disabled Generic Exploit Protection enterprise wide in hope this resolves the issue. We did not see this bahavior in any of our test machines.
Has anyone run into similar?
Hi,
I need helping un-installing the end-point security protection. It requires a password to un-install which I do not have. I have already ran the clean up utility and it did not do anything and the software is still present.
Powershell commands did not work, No registry files can be found in the system.
And I am out of ideas so please be kind and help me.
regards
Taranjot Singh
We need 5901 port need to be open from my PC (10.xx.xx.xx ) few servers . It require for Remote GUI connection (using VNC software)
How can I do it?
We have separate SEPMs. One for managing "All Client machines" and another for manging "All Servers"
So where has this policy to be set? on Server side SEPM or Client Side SEPM?
Was wondering if there is any info when the Kernel for Red hat 7.3 will be supported. Kernel 3.10.0-514.
Currently have SEP for linus 12.1.6 RU 6 installed and getting the "Libraries Not Available" error when trying to compile.
Hi All,
Does SEP 14 beow points
1. IPS - To detect and prevent any form of virus, malware, attacks at hardware/ OS level.
2.Web filtering option where, ads, pop-ups and unwanted sites can be controlled; example ads that pops on Skype and few websites.
3.Anti-virus to do normal scan & on-demand scan from centralized server to all systems as scheduled or as and when required.
4.Reports of the scan that can be exported for review in different formats which should have user and folder level detailed information too that includes which files it scanned as well.
5.Daily, weekly, monthly auto scheduled report generation feature that can be stored and used for audit purpose.
Appreciate any help on this
Hi,
I am newbie to SEP. Existingly we do have 20 PCs are running fine in SEPM.
Recently we had newly installed 10 client windows 7 64 bit but all 10 clients doesn't have the green dot and also show offline in SEPM. 20 PCs are still working fine.
Things we had done:-
1. Ping SEPM server from client vice versa (successful)
2. Browse the web page from client (successful)
3. Telnet to SEPM server with port 8014, 9090, 443, 80 from client (successful)
4. Run command from client nestat -np TCP | find "8014" and status show ESTABLISHED to SEPM server.
5. Replace the sylink.xml from working client to affected client
6. Reinstall SEP to affected client
7. Turn off Windows Firewall from client
8. Delete the legacy proxy setting from client
But still we are having issue with this 10 client PC.
Here is an error log from one of the clients as well
12/06 14:54:08.420 [2108:3600] <SyLink>[MakeRegisterData] registration Hardware Key=1E7B97EE1E47C6AB3ED2D97831AD5155
12/06 14:54:08.420 [2108:3600] AH: Setting the Browser Session end option & Resetting the URL session ..
12/06 14:54:08.581 [2108:3600] <ParseHTTPStatusCode:>500=>500 INTERNAL SERVER ERROR
12/06 14:54:08.581 [2108:3600] <SyLink>[SendRegsitrationRequest] Request Result= 5
12/06 14:54:08.587 [2108:3600] ###### Set ACSConnec offline
12/06 14:54:08.587 [2108:3600] CProfileMgrManPlugin::ReceiveMessage: enter
12/06 14:54:08.587 [2108:3600] ProfileMgrMan: ReceiveMessage with msg id 262146
12/06 14:54:08.587 [2108:3600] CProfileMgrManPlugin::ReceiveMessage: exit
12/06 14:54:08.587 [2108:3600] AVMan: Entering ReceiveMessage with msg id 262146
12/06 14:54:08.587 [2108:3600] AVMan: Leaving ReceiveMessage
12/06 14:54:08.587 [2108:3600] LUMan: Entering ReceiveMessage with id 0x40002
12/06 14:54:08.587 [2108:3600] AtpiMan: Entering ReceiveMessage with msg id 262146
12/06 14:54:08.587 [2108:3600] AtpiMan: Leaving ReceiveMessage
12/06 14:54:08.587 [2108:3600] BashMan: Entering ReceiveMessage with msg id 262146
12/06 14:54:08.587 [2108:3600] BashMan: Leaving ReceiveMessage
12/06 14:54:08.587 [2108:3600] RebootMgrMan: Entering ReceiveMessage with msg id 262146
12/06 14:54:08.587 [2108:3600] RebootMgrMan: Leaving ReceiveMessage
12/06 14:54:08.587 [2108:3600] RepMgtMan: Entering ReceiveMessage with msg id 262146
12/06 14:54:08.587 [2108:3600] RepMgtMan: Leaving ReceiveMessage
12/06 14:54:08.587 [2108:3600] SubmissionsMan: Entering ReceiveMessage with msg id 262146
12/06 14:54:08.587 [2108:3600] SubmissionsMan: Leaving ReceiveMessage
Help would really be appreciated as I am stuck at a loose end!
Thanks.
Dear All,
Was going through all the features of SEP 14, and found that there is a very good multi layered protection cover in SEP 14. There is also the Advanced Machine Learning capability which the upcoming competitors are talking about.
Now with this, my query is why would would we require Additional Endpoint ATP license since Symantec claims that SEP 14 can protect advanced threats. Also competitors like Cylance with AML feature claim that you do not require any addional ATP products
Regards
Deepak
Hi,
Understand that the Symantec Endpoint Protection (SEP) actually save an uploaded file to server first before any scanning took place, is it true? Or is it configurable such that any incoming file is scanned before storing?
Many thanks.
Our infrastructure.
1 SEPM -> 3 GUPS.
The SEPM, and GUPS are on version 14. The workstation clients are running 12.1.X (mostly 12.1.4+ but have a few remaining 12.1.2). Regardless, none of the clients are retrieving updates from the GUPs (the GUPs have the same definition rev as the SEPM).
I've even removed the GUPs from the policy to have the definitions pull directly from the SEPM and that too didn't work.
Please advise.
Thanks,
