Release notes for Symantec Endpoint Protection, Mobile Edition 6.0 and Symantec Network Access Control, Mobile Edition 6.0
|Article:TECH95128|||||Created: 2009-01-21|||||Updated: 2010-01-15|||||Article URL http://www.symantec.com/docs/TECH95128|
This document describes issues associated with Symantec Endpoint Protection, Mobile Edition 6.0 and Symantec Network Access Control, Mobile Edition 6.0. It replaces the readme.txt file included with the software. (Revision: Nov 4, 2009)
The most recent product documentation is available at http://www.symantec.com/business/support/documentation.jsp?language=english&view=manuals&pid=56351.
This article is also available in:
Issues are organized into the following categories:
- System requirements
- Installation / migration issues
- General issues
- Symantec Management Platform issues
- Device issues
- Documentation issues
Symantec Management Platform 7 SP2 HF1 is required
Symantec Mobile Security Solution requires Symantec Management Platform 7 SP2 HF1. Earlier versions are not supported. (Symantec Management Platform was formerly named Altiris Notification Server.)
64-bit support not currently available
This product, including Network Access Control for Microsoft Exchange ActiveSync, currently supports 32-bit (x86) architecture only. 64-bit support is planned for a future release.
Exchange Server 2003 only is supported
Because of the limitations of architecture support, this product currently supports only Microsoft Exchange Server 2003. Exchange Server 2007 support is planned for a future release.
Windows Mobile supported versions
This product currently supports devices that run Windows Mobile 5.0, Windows Mobile 6.0, and Windows Mobile 6.1.
Installation / migration issues
Administrator rights are required to install the solution
The user installing Symantec Mobile Security Solution must have administrator rights.
Make sure to include a license file when you distribute the software for installation on your company's devices. Otherwise, a warning message appears on the device after nine months, and every six months thereafter. For information on how to distribute the license file, see the product documentation.
Restart message on device
To complete installation on the device, users must tap OK on the restart message that appears. This message cannot be cancelled. However, users can move the message around on the screen if they need to finish another task before restarting.
Removing device software unregisters corporate license and might display error messages
When the Symantec Endpoint Protection, Mobile Edition software is uninstalled from a device, its corporate license is automatically unregistered on the Openbit License Manager server. If Symantec Network Access Control, Mobile Edition is removed from a device, its corporate license is automatically unregistered on the Openbit License Manager server. If Symantec Network Access Control, Mobile Edition is removed from a device and Symantec Endpoint Protection, Mobile Edition is then installed on the device, the Symantec Network Access Control, Mobile Edition license is automatically unregistered on the Openbit License Manager server.
In each of these situations, if the device is connected to the Internet, the user might see network connection and data-exchanging messages on the device's user interface. If the device is not connected to the Internet, several error messages might display but the uninstallation should complete successfully. (1785631)
Exclude Data from Device Inventory settings might produce device name synchronization
When running Mobile Security Solution and Mobile Management Solution together on the platform, you should not exclude user data from inventory, especially by checking the "Device user name" and "Device user email address" settings. (See the Symantec Mobile Security Policies folder > Symantec Security Agent Policy tab > Exclude Data from Device Inventory section.) Excluding data by checking these settings might produce device name synchronization problems, where the device name periodically changes depending on which device agent was last to report.
Exchange Server and Altiris Notification Server generate different device IDs
In the event log file, the device IDs generated by Exchange Server are not the same as device IDs generated by Altiris Notification Server. (1602456)
Custom rules are ignored by Symbian firewall
You can add custom rules to the Mobile Firewall Policy. If you have Symbian devices in the group, the custom rules "Allow All" and "Deny All" do not work because they are ignored by the Symbian firewall. On Windows Mobile devices, the custom rules work correctly. Using these custom rules in mixed environments will cause results on Windows Mobile devices to differ from results on Symbian devices. (1782476)
SMS Listener and File Monitoring features
SMS Listener is enabled by default. SMS Listener is automatically enabled if it receives a command to upload the File Monitor log while File Monitoring is disabled. To disable SMS Listener, edit the mobile solution policy (sps.xml). Set SMSEnable = 0.
Some combinations of wildcard characters are not supported
When specifying filenames to be excluded, some combinations of wildcard characters are not supported. Supported is a filename that starts with a dot (.) and ends with an asterisk (*). Not supported is a filename that starts with an asterisk (*) or that includes the question mark (?) wildcard character. For example:
Do not deploy the Symantec Network Access Control policy to your devices before you have first installed the client software
If you use the Symantec Management Console to secure your mobile devices, The Symantec Network Access Control client software must connect to the Notification Server to retrieve the Latest Symantec Network Access Control policy after it completes the initial installation. If you deploy the Symantec Network Access Control policy to the device before installing the client software, the Symantec Network Access Control agent cannot initialize without being able to connect to Notification Server and retrieving the policy.
If you plan to use a 3rd party Mobile Device Management System to deploy your policy files to your mobile devices, you also must first deploy and install the Symantec Network Access Control client software on the devices. If you attempt to deploy the policy file before you install the Symantec Network Access Control client on the device then the Symantec Network Access Control client will not recognize the policy configuration. (1836146)
Policy registration issue
There is an policy registration issue related to the Symantec Network Access Control client software on Symbian devices. The issue is known to occur after installing the SNAC component onto the security agent following a patch to the security agent from Symantec LiveUpdate. You may need to reapply the SNAC policy after you have installed the SNAC Client on the device and the device has registered with Notification Server. (1851668)
AntiVirus does not launch
After activating and licensing the trial version of Symantec Mobile Security Solution, the AntiVirus on the device does not launch if you have performed a Symantec LiveUpdate before you have activated the product. This issue is known to effect Symbian 9.2 and Symbian 9.5 devices
To workaround this issue, you must manually reboot the mobile device. Following the reboot the security agent is the able to register with the Mobile Security Solution and enable Antivirus to work as expected. (1869316)
SNAC for exchange blocking migration issue
If you are migrating from a previous version, you must stop the w3wp.exe process first. (1636554)
Uninstall issue with Network Access Control for Exchange Server
There is in issue found after uninstalling Network Access Control from the Exchange Server where the Network Access Control remains on the server.
After the uninstalling, mobile devices are unable to access the Exchange Server from ActiveSynch and an error code displays an HTTP/1.1 500 internal server error.
To workaround this issue, before you uninstall the Network Access Control for Exchange component, you must first do one of the following:
stop w3wp.exe process before you uninstall
Stop IIS before you can stall
Reboot the server and uninstall before any ActiveSynch traffic occurs (1717128)
Different entries for the same device
The same device has different entries in the mobile resource organization group when the client after applying a LiveUpdate patch. (1846447)
When viewing an event, the search function in the Symantec Management Console has issues in the device event module
In the Symantec Management Console, when viewing an event in the file access log, if you type a search in the search field, a new window is opened but the file access log is not displayed.
To workaround this issue, when you input the search condition in one page, and then another page is opened, if you find there are no logs displayed, you can input the search condition again in the new page's search field. The page should then correctly display the logs that you search for. (1862820)
Patch for Symantec Endpoint Protection Mobile Edition
There is a patch to Symantec Endpoint Protection Mobile Edition that is released with the Symantec Network Access Control Mobile Edition. Before installing Symantec Network Access Control, you need to apply the patch to Symantec Endpoint Protection Mobile Edition. (1849045)
Symantec Management Platform issues
License purchase screen displays prices in Euros instead of local currency
On the page used for purchasing a license, prices might be displayed in Euros instead of your local currency.
Installation configuration files cannot be copied in some mixed-language environments
Installation configuration file (agentInstallConfig.xml) might not copy successfully when all of the following conditions are met:
- A computer running Windows ActiveSync and the Chinese Simplified version of Windows XP, using the default regional settings and language options
- From the Windows XP computer, you use remote access protocol to access a French version of Altiris Notification Server
- The remote access path contains Hi-ASCII characters
- You try to copy an installation configuration file from the Altiris Notification Server to the Windows XP computer
To successfully copy the file, copy it first to an English folder on the French server, and then copy it from the English folder to the computer running Windows XP.
Device is locked by a power save feature
If the device is locked by a power save feature, you can unlock it by either sliding up the device's keyboard or by clicking "Unlock" and then "Home". You can unlock the Dopod C750 by sliding up the keyboard only after completing the installation of Symantec Endpoint Protection, Mobile Edition. (1762409)
Symbian OS 9.4 is not supported
The initial Symantec Endpoint Protection, Mobile Edition 6.0 release does not support devices running Symbian OS 9.4. Additional software to support Symbian OS 9.4 devices is available for download after September 2009 from the Symantec Store at https://fileconnect.symantec.com/
Block Sender not available on Windows Mobile 6.1 Professional Edition devices
On devices that run Windows Mobile 6.1 Professional Edition, the user cannot use SMS AntiSpam to block the sender of an SMS message. There is currently no workaround for this issue. It will be fixed in a future release of the software. Windows Mobile Professional Edition devices include a touchscreen. This issue does not appear on devices that run Windows Mobile 6.0.
Items disappear from Symantec AntiVirus menu on HTC TouchFLO devices
On some HTC TouchFLO devices, items may disappear from the Symantec AntiVirus menu. There is currently no workaround for this issue.
Symantec AntiVirus icon is hidden on HTC TouchFLO devices
When you start your HTC TouchFLO device, you do not see the Symantec AntiVirus icon. This situation occurs because the default HTC Home page covers the icon. To disable the default Home page and display the Symantec AntiVirus icon, do the following:
1. On the device, go to Settings > Today > Items.
2. Uncheck HTC Home, and click OK.
Windows Mobile Spam folder appears in the Inbox folder
On Windows Mobile 6.x, the Spam folder appears within the Inbox folder. This might confuse users who are used to seeing spam outside their Inbox folder.
Symantec icon names do not display entirely
On Windows Mobile devices, some Symantec icons display only the first two lines of their name. This is due to system font size and line space limitations. Without a complete name, you might need to use the following information to identify the correct program.
Symantec Mobile AntiVirus (short name is Symantec AntiVirus) - A yellow circle with a picture of a doctor's stethoscope connected to a cell phone
Symantec Mobile Firewall (short name is Symantec Firewall) - A yellow circle with a picture of a brick wall
Symantec Mobile Security Agent (short name is Symantec Security Agent) - Three yellow, divided parts arranged in a circle
Product documentation does not describe Symbian device settings
The Implementation Guide documentation does not describe the following two settings available on Symbian devices:
- Mobile Agent > Network Setting
- LiveUpdate > Settings > IAP
Help for Symbian devices
The Help for Symbian devices does not include a description for the custom level in the Firewall Settings topic. The description should read "Custom: This level uses the policy created by the administrator for the management console."
The watchdog.exe program is renamed filemonitormgr.exe
The "watchdog.exe" program is renamed as "filemonitormgr.exe". The documentation and Help might still incorrectly refer to "watchdog.exe".
Product references in the documentation might be incorrect
In the Implementation Guide and in the Help, the topic named "Configuring SMS AntiSpam" incorrectly refers to Norton AntiVirus. It should be Symantec Antivirus. The topic named "Setting up SMS AntiSpam rules and conditions incorrectly refers to the Norton icon. It should be the Symantec icon. (1796483)
Description of the "Block network access" action
In the Implementation Guide and in the Help, the topic named "Mobile Host Integrity Policy settings" describes the actions that occur if a Host Integrity check fails. The "block network access" action is described as "Blocks the device from accessing your network." When this action occurs, it does not block all network access. It allows network access according to the settings specified in the Mobile Host Integrity Firewall Policy. (1796651)
Product documentation is not available on product CD
Not all of the documents listed in the "Implementation Guide for Symantec Endpoint Protection, Mobile Edition and Symantec Network Access Control, Mobile Edition" > "Where to get more information about Symantec Endpoint Protection, Mobile Edition" section are available on the product CD. Documents, such as Symantec Management Platform User's Guide (PDF) and Symantec Management Platform Installation Guide (PDF) are available at http://www.altiris.com/Support/Documentation.aspx.
Article URL http://www.symantec.com/docs/TECH95128