Problem
Which parts, components and elements of SEP client destined for 64bit OS are in fact compiled in 32bit and which are in 64bit?
Although SEP client package destined for 64x machines is deployed on a 64x OS, certain elements are confusingly showing themselves in 32bit.
Environment
SEP clients in 64x environment
Cause
Although Symantec provides Symantec Endpoint Protection clients for 64x OS, certain of its internal elements remain in 32bit or have not yet been developed for 64bit machines.
Explanation
By default, SEP client for 64x mode and LiveUpdate are installed in 32bit %ProgramFiles% location:
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection
C:\Program Files (x86)\Symantec\LiveUpdate
1) The following services and processes run exclusively in 64x mode
Symantec Endpoint Protection client
- SmcGui.exe (1 process)
- Smc.exe (1 process)
2) The following services and processes run exclusively in 32bit mode
Installation setup:
- setup.exe (1 process)
- LuCheck.exe (1 process)
- LUSETUP.EXE (1 process)
Symantec Endpoint Protection client
- Rtvscan.exe (1 process)
- ccSvcHst.exe (1 process)
- ccApp.exe (1 process)
LiveUpdate
- LUALL.EXE (1 process)
- LuCallbackProxy.exe (2 processes)
- LUCOMS~1.EXE (1 process)
3) The following services and processes run both in 32bit and 64x mode
Installation setup
- msiexec.exe (up to 4 processes in 32bit and 4 processes in 64x)
4) Other processes activated by Symantec Endpoint Protection
- ProtectionUtilSurrogate.exe (in VMWare environment only, 32 bit, 1 process)
Notes
Tested on SEP client 11.0.6300 RU6 MP3 on Windows Server 2008 R2 FR 64x within virtual environment provided by VMWare ESXi