Cannot deploy AV without running CleanWipe first.

May 2, 2017, 3:41 am

≪ Previous: Risk name: Microsoft® Windows® Operating System?

I need a solution

Hello,

I am trying to deploy Symantec 14 to over 500 clients but having issues.

I have created various MSI packages to deploy the software via GPO but it fails with error 2343 specified path is empty.

The GPO will only install the MSI if I first run CleanWipe on the device.

This is an issue as I have over 500 clients to install the AV on and I cannot run CleanWipe on each of them.

I have tried to create MSI packages that include the option to remove older versions of an AV or Symantec but neither MSI works and gives the same error I said above.

Does anyone have any suggestions to deploy the AV? Remote push doesn't find the devices on our network as we have many VLANs.

Thank you.

↧

SONAR definition out of date

May 2, 2017, 5:03 am

≫ Next: What Symantec directories and processes to exclude

≪ Previous: Cannot deploy AV without running CleanWipe first.

I need a solution

Hi Team,

i am facing one issue that SONAR not getting updates in sep client machines but it's showing "Your computer is protected" and the same SEPM console showing out-of-date. please kindly let me know why it's happening like this.

SONAR.png

↧

What Symantec directories and processes to exclude

May 2, 2017, 7:12 am

≫ Next: 2017 Internet Security Threat Report Now Available

≪ Previous: SONAR definition out of date

I need a solution

I need to know what Symantec Endpoind Protection (v12 and v14 / Win7 and Win10 x64) directories and processes to exclude from other security programs from scanning. Basically, we have some other security products (Malwarebytes and Digital Guardian) and we do not want those products to scan SEP. So I need to know what all to exclude in those programs so it will not scan Symantec processes. I haven't found this in the manual as I have in the other security products.

↧

2017 Internet Security Threat Report Now Available

May 2, 2017, 9:03 am

≫ Next: Clients failing install

≪ Previous: What Symantec directories and processes to exclude

I do not need a solution (just sharing information)

Just raising awareness that the 2017 Internet Security Threat Report is now available. This is a fantastic resource for understanding the threats that your organization is currently facing.

https://www.symantec.com/security-center/threat-report

There will be a free webinar covering the chief points on 16 May:

https://www.symantec.com/about/webcasts?commid=247311&mkt_tok=70138000001BsBZAA0&inid=symc_threat-report_istr_to_leadgen_webcast_commid-247311_2017-istr22-review-threat-landscape

↧

Clients failing install

May 2, 2017, 1:41 pm

≫ Next: problème de replication serveur SEPM 14MP1

≪ Previous: 2017 Internet Security Threat Report Now Available

I do not need a solution (just sharing information)

I've been scratching my head for the last few hours trying to figure out why these Windows 10 clients are failing. I've done the following so far....

disabled windows firewall, ensured remote registry service is running and started, disabled UAC and added registry entry, and disabled Windows defender. Any ideas on what else I can try?

This is a new deployement of SEPM 14 and some are previous clients with 12.x version and/or no AV at all.

↧

problème de replication serveur SEPM 14MP1

May 3, 2017, 2:02 am

≫ Next: Failed Installation and Disconnected network

≪ Previous: Clients failing install

I need a solution

bonjour,

après la mise ç jour des serveurs SEPM 12.1.6MP4 vers la version SEPM 14MP1 ;

la réplication entre les deux serveurs est echouée

↧

Failed Installation and Disconnected network

May 3, 2017, 2:10 am

≫ Next: SEP 14 and 10Gb interfaces

≪ Previous: problème de replication serveur SEPM 14MP1

I need a solution

Hi All, When we try to create an installation package there is some computers that is being disconnected from network and the installation were failed.

I attached the SEPinst logs. Can someone look into it and check what is the problem. Appreciate your help!

↧

SEP 14 and 10Gb interfaces

May 3, 2017, 7:41 am

≫ Next: Migration

≪ Previous: Failed Installation and Disconnected network

I do not need a solution (just sharing information)

Anyone knows if SEP 14 still has troughput problems with 10gb interfaces as seen on:

https://www.symantec.com/connect/forums/slow-10gbps-network-when-symantec-endpoint-client-installed

and

https://support.symantec.com/en_US/article.TECH92440.html

I looked over on release notes and didn't see a mention to this problem. I think the TECH 92440 its the only mention of this issue by Symantec.

Anyone has more input on this situation ? Its unexpected to company this big go for so long without a fix.

↧

Migration

May 3, 2017, 8:06 am

≫ Next: Full protection for servers vs full protection for clients

≪ Previous: SEP 14 and 10Gb interfaces

I need a solution

Ok This is my second post on this... Just need to clarify a few things :

1- I currently have a server running 12.1.5 SEPM on it with Windows 2008 but not the 32 bits

2- Want to migrate to SEPM and client to version 14.

3- I have another server installed and ready with 2008 R2 64bit ( as per requirement for SPEM ) - different IP

4- Did the SEPM 14 install no problem on it.

I want to migrate my client from old server to the new one the easiest way possible.... I have looked at some solution suggested but none worked for me. Client are not migrated at all.... tried to backup DB and restore within the install SEPM 14 but this failed... Just wonder why there is no easy tool to perform this as this is pretty much straight forward. Most ducument i read are talking about version 11 to 12... but not a lot on version 14. I got a couple of workstation installed on the new server and both are working fine. Just not sure what i'm missing....

Any help ?

↧

Full protection for servers vs full protection for clients

May 3, 2017, 8:25 am

≫ Next: ENDPOINT PROTECTION

≪ Previous: Migration

I need a solution

I'm setting up a new "server" in our envrionment, but that server is actually just a laptop running Windows 7 with IIS and coldfusion. I'm getting ready to push the client install package to it and it got me thinking. I know its not a server OS (2008, 2012, etc), but techincally I'm utilizing it as a server even though its running Windows 7. So my question is, what is the difference between full protection for clients and full protection for servers? Can I install the full protection for servers on this box, even though its not running a MS server OS? Thanks in advance

1493827326

↧

ENDPOINT PROTECTION

May 3, 2017, 10:24 am

≫ Next: Installing SEP 12.1.6 MP7 on RHEL 7.3 issues

≪ Previous: Full protection for servers vs full protection for clients

I need a solution

Hello good morning,

I have a problem installing the antivirus from the Endpoint Protection console for a windows 10 pro.The current console of SEPM is version sepm 12.1.6 (12.1 RU6).

I attach the error.

I appreciate your help.

error sep symantec.PNG

1493855903

↧

Installing SEP 12.1.6 MP7 on RHEL 7.3 issues

May 3, 2017, 3:49 pm

≫ Next: Malicious emails with link to infected word documents

≪ Previous: ENDPOINT PROTECTION

I need a solution

I'm trying to install SEP on a fresh RHEL 7.3 os but I cant see to get past the JCE error

# ./install.sh -i
Starting to install Symantec Endpoint Protection for Linux
Performing pre-check...
Error:          Installation requires Oracle Java 1.5 or later whose owner is superuser. Please install the correct version with superuser and Java Cryptogra
Pre-check failed.

I have the JCE package and im running 1.8.0 so I'm a bit confused

# java -version
openjdk version "1.8.0_131"
OpenJDK Runtime Environment (build 1.8.0_131-b11)
OpenJDK 64-Bit Server VM (build 25.131-b11, mixed mode)

root ownership of jvm dir

[lib]# ls -lhat | grep jvm
drwxr-xr-x.  4 root root 4.0K May  3 18:27 jvm
drwxr-xr-x.  4 root root 4.0K May  3 17:26 jvm-exports
drwxr-xr-x.  5 root root  179 May  3 17:26 jvm-private
drwxr-xr-x.  2 root root    6 Jul  2  2015 jvm-commmon

[jvm]# ls -lhat | grep jre
lrwxrwxrwx.  1 root root   35 May  3 17:26 jre-1.7.0-openjdk -> /etc/alternatives/jre_1.7.0_openjdk
lrwxrwxrwx.  1 root root   27 May  3 17:26 jre-1.7.0 -> /etc/alternatives/jre_1.7.0
lrwxrwxrwx.  1 root root   29 May  3 17:26 jre-openjdk -> /etc/alternatives/jre_openjdk
lrwxrwxrwx.  1 root root   21 May  3 17:26 jre -> /etc/alternatives/jre
lrwxrwxrwx.  1 root root   53 May  3 17:26 jre-1.7.0-openjdk-1.7.0.131-2.6.9.0.el7_3.x86_64 -> java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el7_3.x86_64/jre
lrwxrwxrwx.  1 root root   35 May  3 17:24 jre-1.8.0-openjdk -> /etc/alternatives/jre_1.8.0_openjdk
lrwxrwxrwx.  1 root root   27 May  3 17:24 jre-1.8.0 -> /etc/alternatives/jre_1.8.0
lrwxrwxrwx.  1 root root   51 May  3 17:24 jre-1.8.0-openjdk-1.8.0.131-2.b11.el7_3.x86_64 -> java-1.8.0-openjdk-1.8.0.131-2.b11.el7_3.x86_64/jre

[security]# ls -lhat
total 56K
-rw-r--r--. 1 root root 3.0K May  3 17:50 local_policy.jar
-rw-r--r--. 1 root root 3.0K May  3 17:50 US_export_policy.jar
drwxr-xr-x. 9 root root 4.0K May  3 17:24 ..
drwxr-xr-x. 2 root root  153 May  3 17:24 .
lrwxrwxrwx. 1 root root   41 May  3 17:24 cacerts -> ../../../../../../../etc/pki/java/cacerts
-rw-r--r--. 1 root root  141 Apr 13 18:13 nss.cfg
-rw-r--r--. 1 root root 1.3K Apr 13 18:05 blacklisted.certs
-rw-r--r--. 1 root root 2.5K Apr 13 18:05 java.policy
-rw-r--r--. 1 root root  32K Jan  1  2014 java.security

As shown above I've updated the JCE policies (from here - http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html)

Full java directory is

/usr/lib/jvm/jre-1.8.0

I'm sure I'm just overlooking something but I'd appricate any help

Thanks

↧

Malicious emails with link to infected word documents

May 3, 2017, 11:28 pm

≫ Next: Process to turn a Standard Client into a Dark Network Client

≪ Previous: Installing SEP 12.1.6 MP7 on RHEL 7.3 issues

I need a solution

Hi there,

i just try to find out how this is possible without finding any virus on any device.

Lately we or our customers are getting emails that look like they are sent from the customer to us or from us to them.

The interesting thing is. The two persons are ALWAYS connected. They know each other. But the email address is wrong,

It looks for me that the GAL or maybe XING was compromised.

Some user trust the email sender name (not email address) and open the word document. Symantec caught some of them (but not all).

Anyone else experiencing this?

Best regards

Stephan

↧

Process to turn a Standard Client into a Dark Network Client

May 4, 2017, 4:34 am

≫ Next: Sage 200 crashing under SEP12

≪ Previous: Malicious emails with link to infected word documents

I need a solution

Hi there,
Trying to find a way how to turn a SEP14 Standard Client into a SEP14 Dark Network Client. So far, BCS Support have said so far, that uninstall / reinstall is the only way. Don't think that this is a very feasible way in server environments.
In case there is really now other way to do so, this should be considered in the next SEP14 versions.
Input / feedback is appreciated.
Cheers,
Michael

↧

Sage 200 crashing under SEP12

May 3, 2017, 1:11 pm

≫ Next: Demande informations

≪ Previous: Process to turn a Standard Client into a Dark Network Client

I need a solution

I had this problem before and I posted it here- SAGE200 crash's

ABSTRACT:
Sage repliesare, SAGE200 crash's will be SEP12 fault, whatever, get back to drawing board setup everything again, more crashes later, more blames to SEP12...

back and forth argh... you got the picture.

I done lot of work to put the SAGE200 app. through the SEP12 whitelist.

Very recently I had another crash, a different one, got back to sage200 support team, this time the problem was with C:\Users\Santos\AppData\Roaming\Sage 200\Sage.MMS.Desktop.Common.Resources.dll

Sage is telling me again that is SEP12 fault, however SAGE team never advised me before to add that .dll to the SEP12 whitelist.

Is anyone there able to help me? I need a strong argument with SAGE team rather than just nodding at them.

Much Appreciated

↧

Demande informations

May 4, 2017, 5:39 am

≫ Next: SEP and Digital Guardian

≪ Previous: Sage 200 crashing under SEP12

I need a solution

Bonjour à tous,

Je suis à la recherche d'informatiosn techniques sur la version du Symantec Endpoint Protection 14 MP1a.

Auriez-vous des liens web vers des vidéos de formations gratuites (genre PartnerSymantec)

En vous remerciant par avance.

================================================================================

Hello to all,

I'm search of tehnical information on the version of the Symantec Endpoint Protection 14 MP1a.

You would have Web links towards videos of free trainings(PartnerSymantec....)

Thank you in advance.

↧

SEP and Digital Guardian

May 4, 2017, 6:54 am

≫ Next: Still infected virus in windows XP

≪ Previous: Demande informations

I need a solution

Posting out here to see if anyone is using Verdasys Digital Guardian DLP agents alongside of their SEP clients. We have recently rolled out Digital Guardian, and have had a ton of issues such as performance issues, systems hanging at bootup, Excel errors, etc. I don't know if it has anything to do with SEP as we are still investigating, but wondering if anyone has this combination of products and what your success is. Thanks for any information.

↧

Still infected virus in windows XP

May 4, 2017, 10:16 pm

≫ Next: How do I totally disbale SEP?

≪ Previous: SEP and Digital Guardian

I need a solution

Hi,

i was facing with malware continuosly in windows XP machine. i have done mutliple troblueshooting both client and server side. please help me out.

it is showing scantype Defwatch

↧

How do I totally disbale SEP?

May 5, 2017, 10:43 am

≫ Next: Message each time I star up the app

≪ Previous: Still infected virus in windows XP

I need a solution

I'm running an unmanaged client on Windows 10. I'm currently writing a program, and whenever I compile the .exe, SEP keeps detecting as a Trojan and deleting it. When I right-click the icon and choose disable, it seems to be disabled, but about 15 minutes later the "SEP is analyzing the risks" window pops up and it deletes it again. I don't want to have to uninstall it, but I can't find any solutions online. How do I totally and completely disable SEP until I manually re-enable it? Thanks!

↧

Message each time I star up the app

May 5, 2017, 11:09 am

≫ Next: add additional SEPM to existing site with existing embedded DB

≪ Previous: How do I totally disbale SEP?

I need a solution

Each time I start up the Syamntec Endpoint Protection App on Windows 10, I get a maessage saying 'Do you want to allow this app to make changes to your device?'. Does this mean Symantec is working or do I need to configure the settings to enable Symantec to work properly? Any feedback is grealy appreciated.

↧