Unable to Apply Policy to SCSP Agent - Policy Application Fails with "Unknown Error"

Article:TECH201666  |  Created: 2013-01-15  |  Updated: 2013-01-15  |  Article URL http://www.symantec.com/docs/TECH201666
Article Type
Technical Solution


Issue



Unable to apply updated IPS policies to Symantec Critical System Protection (SCSP) agent.


Policy application fails with "Policy Translation Failed: Unknown error"


Error



 After enabling Trace Debugging, one of the following errors will be present in the \Symantec\Critical System Protection\Agent\scsplog\SISIPSService.log file:

TRAC,80,2013-01-11 13:02:23.625 Z-0500,T,0,,<32bit GUID>,-1,,,,,UpdateThread,,,,,,,,,Error running Translator -1073741502

or 

TRAC,59,2012-12-12 23:59:47.243 Z-0800,T,0,,<32bit GUID>,-1,,,,,UpdateThread,,,,,,,,,Error running Translator 128

 


Environment



This can be reproduced by running psexec (a Systernals tool) to attempt to open up a command window on the affected machine.  An error will be thrown that when researched will point back to Desktop Heap Exhaustion.


Cause



Desktop Heap Exhaustion.

In one case, the issue was a script that was running over and over but did not close the handle after it ran. This used up the desktop heap space, causing this issue, along with a Policy Override Tool failure

In another case, the cause was found to be the following:

Original 2006 article applying to Windows NT:
http://support.microsoft.com/kb/156484

Explanation of the issue as applies to Win XP, Win 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;184802

 


Solution



Fix homegrown script or other running process to close its handles after it runs.

Or

For some ways to address the issue: 
http://support.microsoft.com/kb/126962




Article URL http://www.symantec.com/docs/TECH201666


Terms of use for this information are found in Legal Notices