Hi team,
Can you anyone tell what happen if we upgrade the server to 12.1 RU2 MP1 , and the client version will be 12.1 RU1 MP1.
Are there any impacts an above scenario? Like bandwidth issues while client downloading defs from SEPM server. Or any other issues.
We will upgrade the clients after server upgrade may be 1 or 2 months, in the mean time we need to test the clients with new version before go to production systems.
I have around 300 SEP clients running version 11.x that I am looking to upgrade to 12.x. I know hardware and other items factor in, but is there a hard limit or recommended threshold for the number of clients that can be upgraded from SEPM doing a push?
Hi, when I try login to the SEPM, I recive the error:
"Failed to connect to the server.
Make sure that the server is running and your session has not timed out.
You can reach the server but cannot log on, make sure that you provided the correct parameters.
If you are experiencing network issues, contact your system administrator."
When I start the service Symantec Endpoint Protection Manager, after few seconds stops.
We have AD integrated Environment we want to Create group wise sep client updating and other type report.
How can be find this reports if it’s possible?
Due to some internal audit purpose we need to know where we find sep client installation date.
I have tried but unable to find in sepm console please let me know where we can get it.
Error in monitor tab
Hi everyone,
While creating Application and device control policy to block bluetooth devices, I came to know that in predefined list of devices, there are 2 options to choose from in case of bluetooth. One is "Bluetooth Radios" and other is "Bluetooth devices (Generic)". Can anyone please let me know what is the difference between the two and how the choice will affect the output????
Regards,
Darshan G. Parab
How to block ESATA?
Hi Support,
We need help in SEP client. I have a SEP 12.1 RU1 client machine. I am using VPN connection on SEP client to connect client to other location. But my VPN connection disconnect every four hours. I had also check network traffic and packet log but there is not show any block information. After that i had also disabled SEP client firewall and exculde local IP address on intrusen prevesion. But the problem still not resolved.
If I removed SEP from client then VPN is working fine.................Please help me.....
Hi,
I'm new to symantec endpoint protection. One of our client not getting update, showing offline in console, services stopped in client machine.
Can anyone help
Which services need to start?
Regards
TK
I've tried all kinds of things that I've read that have helped others with this problem and so far all have failed. I had SEP installed and noticed that its Firewall wasn't active. I wasn't able to activate the Firewall so I uninstalled SEP and my attempts to re-install have not been successful.
I'm running Windows 7 Home Premium SP1 32-bit. I'm trying to install Endpoint Protection 12.1 RU2 (32bit). SEP-INST.log output is attached in a .zip file.
Hi all,
Environment： Server 2003, VM ware
I installed twice. it rolled back itself from the log.
I've wiped out all the regestry info about symantec client and the related folder on Drive C.
and tried again, but it is still the same.
In addtion, Once, I happened to see the error message about the Visuall C++ library which might have something to do with this.
I've uploaded the MSI logs for your study attached below.
Thanks for your help and advice in advance.
FYI: Parts of the logs
The full content logs is attached.
Property(S): ProductToBeRegistered = 1
Property(S): MsiFilterRebootMode_RebootAtEndModeBefore = 1
MSI (s) (FC:D0) [10:48:00:477]: Note: 1: 1708
MSI (s) (FC:D0) [10:48:00:477]: Product: Symantec Endpoint Protection -- Installation operation failed.
MSI (s) (FC:D0) [10:48:00:555]: Cleaning up uninstalled install packages, if any exist
MSI (s) (FC:D0) [10:48:00:555]: MainEngineThread is returning 1603
MSI (s) (FC:B8) [10:48:00:555]: Destroying RemoteAPI object.
MSI (s) (FC:B0) [10:48:00:555]: Custom Action Manager thread ending.
=== Logging stopped: 4/18/2013 10:48:00 ===
MSI (c) (A8:94) [10:48:00:570]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (A8:94) [10:48:00:570]: MainEngineThread is returning 1603
=== Verbose logging stopped: 4/18/2013 10:48:00 ===
Hi all,
Environment： Server 2003, VM ware
I installed twice. it rolled back itself from the log.
I've wiped out all the regestry info about symantec client and the related folder on Drive C.
and tried again, but it is still the same.
In addtion, Once, I happened to see the error message about the Visuall C++ library which might have something to do with this.
I've uploaded the MSI logs for your study attached below.
Thanks for your help and advice in advance.
FYI: Parts of the logs
The full content logs is attached.
Property(S): ProductToBeRegistered = 1
Property(S): MsiFilterRebootMode_RebootAtEndModeBefore = 1
MSI (s) (FC:D0) [10:48:00:477]: Note: 1: 1708
MSI (s) (FC:D0) [10:48:00:477]: Product: Symantec Endpoint Protection -- Installation operation failed.
MSI (s) (FC:D0) [10:48:00:555]: Cleaning up uninstalled install packages, if any exist
MSI (s) (FC:D0) [10:48:00:555]: MainEngineThread is returning 1603
MSI (s) (FC:B8) [10:48:00:555]: Destroying RemoteAPI object.
MSI (s) (FC:B0) [10:48:00:555]: Custom Action Manager thread ending.
=== Logging stopped: 4/18/2013 10:48:00 ===
MSI (c) (A8:94) [10:48:00:570]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (A8:94) [10:48:00:570]: MainEngineThread is returning 1603
=== Verbose logging stopped: 4/18/2013 10:48:00 ===
Bonjour à tous,
Dans le dossier suivant:
C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions
Les fichiers atteignent une taille de plus de 15Gb.
Savez-vous comment nettoyer tout ça ?
C'est une quantité beaucoup trop importante pour être laissée dans le disque C: du serveur.
Meilleures salutations
Hi,
I need to know the best practices to upgrade SEPM v 12.1.100 to 12.1.1, also need to know there is any problem id i install cliend with IPS and Sonar features on servers like AD, Exchange.. !!!
Thanks
Hi Team,
Qurantine size increasing on Server 2008 and client version is 12.1 RU2.
Which setting can i configure so Qurantine size decrease as well as How can i configure Limite of size.
I have SEP 2012 installed on a Windows 2008 Ent R2 server, running SEPM for our organization.
I have a series of event logs that keep popping up aveyr minute or two. It looks like a process called USNWash.exe is trying to start, which in turn starts conhost.exe, and then both terminate immedietly. It is causing a lot of chatter in my security event log on this server.
What is USNWash.exe? It is part of SEP, I just cannot tell what it does or why it keeps trying to spawn. Here you can see both processes start, then immedietly terminate. This happens every minute or so:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 4/22/2013 12:06:08 PM
Event ID: 4688
Task Category: Process Creation
Level: Information
Keywords: Audit Success
User: N/A
Computer: xxxxxxx
Description:
A new process has been created.
Subject:
Security ID: SYSTEM
Account Name: xxxxx
Account Domain: xxxxxx
Logon ID: 0x3e7
Process Information:
New Process ID: 0x1980
New Process Name: D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin\USNWash.exe
Token Elevation Type: TokenElevationTypeDefault (1)
Creator Process ID: 0x1114
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 4/22/2013 12:06:08 PM
Event ID: 4688
Task Category: Process Creation
Level: Information
Keywords: Audit Success
User: N/A
Computer: xxxxx
Description:
A new process has been created.
Subject:
Security ID: SYSTEM
Account Name: xxxxx
Account Domain: xxxxx
Logon ID: 0x3e7
Process Information:
New Process ID: 0x1efc
New Process Name: C:\Windows\System32\conhost.exe
Token Elevation Type: TokenElevationTypeDefault (1)
Creator Process ID: 0x174
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 4/22/2013 12:06:08 PM
Event ID: 4689
Task Category: Process Termination
Level: Information
Keywords: Audit Success
User: N/A
Computer: xxxxx
Description:
A process has exited.
Subject:
Security ID: SYSTEM
Account Name: xxxxx
Account Domain: xxxxx
Logon ID: 0x3e7
Process Information:
Process ID: 0x1980
Process Name: D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin\USNWash.exe
Exit Status: 0x40000001
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 4/22/2013 12:06:08 PM
Event ID: 4689
Task Category: Process Termination
Level: Information
Keywords: Audit Success
User: N/A
Computer: xxxxx
Description:
A process has exited.
Subject:
Security ID: SYSTEM
Account Name: xxxxx
Account Domain: xxxxx
Logon ID: 0x3e7
Process Information:
Process ID: 0x1efc
Process Name: C:\Windows\System32\conhost.exe
Exit Status: 0x0
Thanks!
Hello,
Reviewing our logs, I've found a virus alert that SEP12 has the Actual Action listed as "Moved Back". I've found reference to this in the Actual Action Schema (ActualAction_9 = Moved back) but I cannot determine what this means in simple terms.
We are reviewing these events to determine if SEP12 has effectively mitigated the file in question or additional actions would need to be taken (such as with the Actual Action "Left Alone").
Any help or guidance would be much appreciated.
Thanks,
John
Hi ,
we are planning to migrate teh SQL database from 2005 to 2012.. we have one primary server and one secondary server.
Database is installed on Primary server. No database on Secondary server. Is there any Documents for this?
After SQL migration , did we need to re confiure SQPM sever. are any requirments required for this?
Application: Autonomy (desksite) Manage.exe
OS: Win 7
I'm currently piloting SEP for our enterprise, and have stumbles upon an odd issue. So far I have SEP installed on about 100 systems. All of them are Windows 7, and about 90% of them are able to launch and run this application just fine. However about 10% of the systems (8-10) error out when launching mange.exe.
The error received is
"Manage32.exe - Application Error"
The Application was unable to start correctly (oxc0000005). Click OK to close the application.
When I uninstall SEP and restart the system the application launches just fine.
The only thing that has worked so far is building a custom client build without "Application, and Device management" feature.
This has us really stumped because this is only affecting about 10% of our systems. All the systems have the exact same build.
Thanks,
Mike