Symantec Endpoint Protection: Event ID 4097 and 4096 occur near 4:00 AM on a Windows 2003 Small Business Server

Article:TECH103105  |  Created: 2007-01-14  |  Updated: 2009-01-03  |  Article URL
Article Type
Technical Solution



Event IDs 4097 and 4096 are listed in the Windows Event Logs at 4 AM on a Windows 2003 Small Business Server.

In the Application Log of the Windows event viewer there are the following errors reported by secars:
  • Event ID 4097: src = seacars ... "Failed to start radius server the radius port may be used by another process. "
  • Event ID 4096: src = secars ... "Create log file error ... "

Net Stat shows that nothing is running on port 1812


Symantec Endpoint Protection stops "secars" to allow the Exchange maintenance cycle. The Exchange maintenance cycle starts at 4 AM by default on a Windows 2003 Small Business Server.


This problem is fixed in Symantec Endpoint Protection Manager 11.0.2000 build 1567.

For information on how to obtain the latest build of Symantec Endpoint Protection, please read the following document:
Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x.

Supplemental Materials


Legacy ID


Article URL

Terms of use for this information are found in Legal Notices