Microsoft cluster resources fail to transition from one node to another within the cluster after Symantec Endpoint Protection 11.0 RU5 installation

Article:TECH97096  |  Created: 2009-01-28  |  Updated: 2010-12-10  |  Article URL
Article Type
Technical Solution


After you install or migrate to Symantec Endpoint Protection (SEP) 11.0 Release Update 5 (RU5) on your Microsoft cluster nodes, cluster resources (shared disk, quorum drive, etc.) can no longer fail over from one node to another.


  • In cluster administrator, the status of these resources is shown as failed.
  • Windows system event log and cluster log contain disk corruption errors and state that chkdsk.exe is required to run.
  • Using Microsoft handle.exe tool to get all the open handles, you will see output similar to below:

Smc.exe pid: 832 NT AUTHORITY\SYSTEM
700: File (RW-) Q:

  • If Symantec Management Client (SMC) service is stopped, the issue goes away.
  • If revert to a SEP client version prior to RU5, the issue goes away.



Symantec has released a product to resolve this issue. The fix has been included in Symantec Endpoint Protection 11 RU6.

Note: SEP 11 RU5 was the first client with official support for Windows 2008 R2. Migrate up to SEP 11 RU6 to resolve this issue, or downgrade to SEP11 MR4 MP2 if your policies require you to test with the newly released support products before introducing them in your production environment. SEP11 MR4 MP2 can be installed to Sever 2008 R2, but you first must install Liveupdate (lusetup.exe), and then install the MR4 MP2 client.

Location to download Microsoft Handle tool -

Legacy ID


Article URL

Terms of use for this information are found in Legal Notices