Unable to Apply Policy to SCSP Agent - Policy Application Fails with "Unknown Error"
|Article:TECH201666|||||Created: 2013-01-15|||||Updated: 2013-01-15|||||Article URL http://www.symantec.com/docs/TECH201666|
Unable to apply updated IPS policies to Symantec Critical System Protection (SCSP) agent.
Policy application fails with "Policy Translation Failed: Unknown error"
After enabling Trace Debugging, one of the following errors will be present in the \Symantec\Critical System Protection\Agent\scsplog\SISIPSService.log file:
TRAC,80,2013-01-11 13:02:23.625 Z-0500,T,0,,<32bit GUID>,-1,,,,,UpdateThread,,,,,,,,,Error running Translator -1073741502
TRAC,59,2012-12-12 23:59:47.243 Z-0800,T,0,,<32bit GUID>,-1,,,,,UpdateThread,,,,,,,,,Error running Translator 128
This can be reproduced by running psexec (a Systernals tool) to attempt to open up a command window on the affected machine. An error will be thrown that when researched will point back to Desktop Heap Exhaustion.
Desktop Heap Exhaustion.
In one case, the issue was a script that was running over and over but did not close the handle after it ran. This used up the desktop heap space, causing this issue, along with a Policy Override Tool failure
In another case, the cause was found to be the following:
Original 2006 article applying to Windows NT:
Explanation of the issue as applies to Win XP, Win 2003
Fix homegrown script or other running process to close its handles after it runs.
For some ways to address the issue:
Article URL http://www.symantec.com/docs/TECH201666