Screencasts - Hilfsvideos
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SEP makes the computer very slow.

Created: 02 Aug. 2012 | 74 Kommentare

On some computer SEP 12.1.1 use alot of resources and makes the computer very slow.
At this moment we have 20 computers that have this isseu. And with slow i mean very slow. 30-40 minutes you have to wait when you log in. And when your work you have to wait 2-5 minutes for opening a document. When we remove the SEP client, everything is back to normal. We did a reinstal of two computers but that didn't help alot.  

The computers al have 2+GB RAM, other computers with the same spec doesn't have this problems...

And when we install a client with only Anti-virus and Anti-spyware. Its better but it still take 15 minutes to login.

Someone have experience with this issue?

Kommentare KommentareZum neuesten Kommentar

das Bild der Swapnil khares

Check this might help if this was something known there must be Fix released by Symc check Symantec in article below for know issue's

http://social.technet.microsoft.com/wiki/contents/articles/10130.root-causes-for-slow-boots-and-logons-sbsl.aspx

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

das Bild der Glenn Jacobss

It is not really the login thats the problem but after you login the computers hangs a while before you can do something.

After a few tweaks this problem is solved i think but the computer is stil very slow when you work with it.

das Bild der Swapnil khares

Glenn ,

Could you please check the event log i guess there should be event mentioning event id 10xxx something

and the solution is to change the dcom settings i had dealt with similar issue earlier and had helped fixing issue after changing permission on machine , try this on 1 machine only ie workstation as a test you might have to login as Admin to make change ,

Note do not make changes on SEPM server try giving affective dcom permission on Client first and then check if it works .

http://answers.microsoft.com/en-us/windows/forum/windows_xp-performance/dcom-error-10010-very-slow-login-very-slow-desktop/4614ae6d-93cd-45e6-b66a-cbde1db13f90

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

das Bild der Thomas Ks

Are you running any other security products on these systems? What is the operating system used?

das Bild der Glenn Jacobss

We don't run any other security products on the system. We have other computers with same hardware s and the same software but they don't have any issue.

We have Windows XP.

das Bild der K33s

Kindly verify...............

have you check reinstall window ?

This issue is rendomly or some specify system  ?

Virus defination are up to date ?

Some time this issue occured when lot of user profile are exit in System and low space in c drive.

kindly change one system pagefile location.(Only for Troubleshooting)

das Bild der Glenn Jacobss

This issue is randomly or some specify system?
It's More randomly, but at this moment 70 % of the computers that are affected by this issue are computer from the IT department.

Virus defination are up to date?
yes

Some time this issue occured when lot of user profile are exit in System and low space in c drive.
Alot of profiles isn't possible. Will check low space...

Kindly change one system pagefile location.(Only for Troubleshooting).
On the list to try this.

das Bild der K33s

hi,

Thanks for update..

Kindly verify more ..

Slowness problem occure one time in day ?

Kindly check when your system are slow can you check virus defination folder created date.

Locations of Virus Definitions for SAV or SEP Client only:

  • Windows 9.x\Windows XP\Windows Server 2003:  \Program Files\Common Files\Symantec Shared\VirusDefs\ or \Program Files (x86)\Common Files\Symantec Shared\VirusDefs

Same problem occure in my company when system start system goes slow after 25 to 30 min.this problem occure every 8 hours,when we have check virus defination folder Created date and time are same.

das Bild der hformans

On just a few systems, we had to first:

1) Uninstall SEP 11

2) Remove everything symantec from folders (program files, common files, profiles - especially "all Users")

3) do reboots after each step

4) Check disk space

5) Make sure we didn't touch anything relating to other Symantec products, such as NetBackup

6) Perorma clean push install using the wizard.

The reason is that we still had pieces of very OLD SAV software on some machines.

das Bild der Glenn Jacobss

We reinstalled the system so just cleaning up will not work for us. Its even on new systems.

das Bild der hformans

Excuse me:  also--

We had turned on Isight and SONAR.  No problem except we needed to have exclusions, especially in Blue Coat for some of the new Symantec websites, such as:

ent-shasta-mr-clean.symantec.com and

ent-shasta-rrs.symantec.com

I would check the following logs (most under Network Threat Protection):

SONAR

TRAFFIC

PACKET

and see if anything new is getting stopped.

das Bild der Glenn Jacobss

I don't know if we have thos exclusions in our bluecoat will check this. I don't think this will solve our problem but i'm out of idea right now so i gonna try those exclusions if they aren't already there.

I found a list of Proxy exclusions here: http://www.symantec.com/business/support/index?page=content&id=TECH162286

Do i need to add all of them for everyone or just from our SEPM server?

das Bild der hformans

You need to add them for everyone.  We have *.symantec.com whitelisted.  You may want to note that most of these are https: sites (not port 80).  Each computer, when it scans, will be accessing those sites.

das Bild der Dushan Gomezs

Yes, I guess I'm not alone in this too, my WIndows XP SP3 user report the same thing when opening their Outlook 2007 after upgrading to SEP v12.1 RU1

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

das Bild der Glenn Jacobss

We didn't get alot of complains from the users, so we don't really know how many PC are affected by this problem. But there are some ppl in our IT Department taht have this issue and it isn't only related to Outlook. Startup is very slow, We know that SEP will slow down the boot process.But this is to much.

We don't really care if the systems takes a little more time to boot but when we start software (Local installed software and APP-V) It takes up to 5 minutes to open. We can have 2 system (Same hardware and software) but one does have the problem and the other doesn't have it. The only differences are the MAC/IP and systemname.

das Bild der Ashish-Sharmas

This is a shot in the dark, but try disabling Insight lookups for a test and see if this has any impact on performance.

How does Insight Lookup work? - http://www.symantec.com/business/support/index?page=content&id=TECH169282

Thanks In Advance

Ashish Sharma

das Bild der Dushan Gomezs

Hm.. didn't think about that before :-0

Thanks for the advice Ashish

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

das Bild der Ashish-Sharmas

have you check system speed after setting ?

Thanks In Advance

Ashish Sharma

das Bild der Glenn Jacobss

It gave maybe a 15% extra speed on those computer. I'm  happy is 15% so our user know we are trying to fix it... 

das Bild der sagar pansares

Check this might help

Go to: C:\Program FIles\Symantec\Symantec Endpoint Protection Manager\Inetpub\Content (Default Location of SEPM) 

 Check

- {535CB6A4-441F-4e8a-A897-804CD859100E} for 32 Bit

- {07B590B3-9282-482f-BBAA-6D515D385869} for 64 Bit

Note: These two folders take more disk space, compared to other folders which are used to store the Virus definitions

 Once the number of content revisions has been decreased, then this would be reflected on the number of revision folders. See TECH96214 for recommendations.

 To reduce the size of the database transaction log file

 Log in to the Symantec Endpoint Protection Manager.

 Click Admin and select Servers.

 Select the localhost under Servers.. Under Tasks, Select Edit Database Properties.

.In the General tab under Database Maintenance Tasks.

 Select the checkboxes next to Truncate the database transaction logs and Rebuild Indexes.

 Click OK to apply the changes.

das Bild der Glenn Jacobss

We keep 25 revisions (we have 2100+ clients). I don't know this will fix the problems on the clients because this is server related and we only have a problem with a few clients. But will try this later when i checked the system speed after the change we did last week. But i didn't have alot of time to check this now.

das Bild der Glenn Jacobss

Another strange thing:

next year we will roll out Win 7 instead of XP we are doing tests now and i changed one of those systems to Windows 7. Problem is gone. Change back to Win XP problem back....

das Bild der hformans

Is there any difference in your Windows firewall settings?  I set SEP 12 to disable the Windows firewall since having two firewalls running could slow down things.  You also would need to check out the difference between your XP and Win 7 images.  They are probably not exactly the same.  Also, make sure you don't have duplicate SIDs in your envirnment.  There is a lot of software we have seen that is sensitive to that (mostly patching systems).

das Bild der Ashish-Sharmas

Does your XP computers meet the minimum system requirements?

Processor
  • 32-bit: 1-GHz Intel Pentium III or equivalent minimum (Intel Pentium 4 or equivalent recommended)
  • 64-bit: 2-GHz Pentium 4 with x86-64 support or equivalent minimum
    Note: Intel Itanium IA-64 and PowerPC processors are not supported.
Physical RAM
  • 1 GB of RAM for 32-bit operating systems, 2 GB of RAM for 64-bit operating systems, or higher if required by the operating system

http://www.symantec.com/products/sysreq.jsp?pcid=p...

Thanks In Advance

Ashish Sharma

das Bild der Glenn Jacobss

We have Dell systems and they all have 2gb ram+ and Dual core processors (I think 1.8Ghz+)

das Bild der Ashish-Sharmas

SEP 12.1 lot of new feature are available that cause windows xp OS are slow working.

Try on import SEP 11.x client package on SEPM 12.1 and check 1 or 2 system performance.

How to import SEP 11.x package in SEPM 12.1

https://www-secure.symantec.com/connect/articles/how-import-sep-11x-package-sepm-121

Thanks In Advance

Ashish Sharma

das Bild der Glenn Jacobss

We already imported SEP 11 packages (there are some problems with Thinapp).

Installed it and the problem is gone with SEP 11...

das Bild der williamzhongs

we have the same problem on some windows2003 server enterprise edition sp2 system,but when i dial the symantec support line ,they don't have any idea about this issue.

well,finally ,we had to reboot the server and uninstall the sep 12.1 client.

i think ,this problem must be caused by sep client.

das Bild der Glenn Jacobss

We think its more a combination of different software.

like there are some user that have a standard but with alot of extra software. And with alot I am talking about 15+, most of them are from our IT department.

But the problem is also there but alot of other user but tey are spread over our company. But if we see how many per department. IT has more then the other department (3 x more).

das Bild der hformans

Please make sure that you are not blocking access to any sites, http(s):// *.symantec.com.  SEP 12 does a lot of checking on reputation and the sites are all listed somewhere.  They don't use liveupdate, exactly for this.  We don't have any performance issues with 12.1.1.

You may also want to look at the different logs to make sure nothing is being blocked, such as SVCHOST.EXE.  You must create an exclusion for that as it tries to access the hosts file.

das Bild der Glenn Jacobss

https domains aren't blocked in our company.

http://*symantec.com is whitelisted on our proxy and it doesn't need any authentication to reach it.

das Bild der hformans

Thanks, without seeing all of your logs I was just checking.  For what it is worth, we are running XP SP3 and Windows 7 mixed and are not seeing any issue.  I check the logs every day and find all sorts of new things that we never knew were going on.  We are using both SONAR and Insight and it is dramatically reducing scanning here.  Since some of the "policies" have new things in them, my only suggestion at this point would be to go over yours carefully (between 11.x and 12.x).  (Especially Firewall rules).  Good luck.

das Bild der poly15s

Are these all at one site or at a remote site?  Are you going back to a server for updates or out to the internet?  Are your proxies transparent or static?

das Bild der Glenn Jacobss

Both most part is on a remote site but we also have this problem on the site were our server is located.

We use our server for updates.

What is the difference between transparent and static proxy?

das Bild der John Santanas

Hi,

Is this still the issue with SEP client version 12.1 RU1 MP1 deployed to WIndows XP SP3 ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

das Bild der Glenn Jacobss

Its still an issue, and we even think it got a little bit worser but we only think it smiley We can't deny it or prove it....

With the latest version we got more computer that have this issue but we need this version. Other version has problem with APP-V and 75% is APP-V

On Win7 we see alot of improvements, we didn't had a chance to check it on an 'clean' win XP SP3

Reinstal the computer have a little succes (it will speed up those computers but not enough).
We already have a case by symantec but we also know its a high chance that this problem is a configuration thing (OS- third party software in combination with SEP.)

das Bild der John Santanas

Ah that's sounds great Glenn, because my company will soon migrate to Windows 7Pro next year.

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

das Bild der .Brians

What processes are utilizing the most CPU?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

das Bild der Glenn Jacobss

Non active system processes are 99%

other processes are around 0-1%

das Bild der Mohan Babus

Hope the slow logon issue might because of SEP scanning NTUSER.DAT file..

So users will be facing this slowness prroblem

Try to add a exlusion for one user profile and check if tat works...

Bot we don't have a option so set wildcard for this 

Better you can stop Active scan on startup...for better performance.

Go to SEPM-->Policy-->Virus and spyware policy-->edit the scan policy and disable the active scan on windows start up.

Check these articles for more info.

https://www-secure.symantec.com/connect/forums/rtvscanexe-scaning-all-cusersxxxntuserdat-endlessly

https://www-secure.symantec.com/connect/forums/how-stop-scanning-ntuserdat

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

das Bild der John Santanas

Mohan, what are the tweaking method to make SEP runs faster and safer in the WIndows XP client ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

das Bild der Zebbelins

We had a similar Problem with the long logon times on:

  • Windows XP
  • Sites with no Domain Controller

We fixed it by adding the "BufferPolicyReads" Reg Key described in this Blog:

http://blogs.technet.com/b/instan/archive/2011/08/...

But I have no idea where that slow open documents thing could come from.

Hope the info helps you!

Have you tried to uninstall the Network Threat Protection part to see if the Network Performance is still bad?

das Bild der Mohan Babus

Hi John Santana

If you install all components you need to make sure your environment need all the features. You can avoid the some features that you may not use on your environment.

Scan suggestions:

Antivirus & Antispyware:

Settings need to configure:

  • You can schedule the scan frequency and Scan randomization out of productivity hours.
  • Scan settings should be selected as Better performance for other applications
  • Scan when a file is modified
  • Set exclusions for legitimate files 

PTP [Proactive threat protection]  

TrueScan : It will scan all the process that runnin on your Memory. You can set the Heuristic level to medium or low to avoid False  Positives and better performance.

Appplication & Device control: Block or monitor the applications and devices.

If you dont' USe you can remove them.

NTP [Network threat protection]

Firewall: Works based on rules block allow or log the inbound or outbond traffic

Configure the firewall according to the enivronment

IPS: Works based on signatures.

Adjusting scans to improve computer performance
 
 
Randomizing scans to improve computer performance in virtualized environments
 
 
Improving client and server performance
 

Hope this helps,........

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

das Bild der John Santanas

Many thanks Babu !

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

das Bild der Mohan Babus

Welcome always.........John Santana

Hope you got the required information............

Is there anything else i can help you with...........

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

das Bild der tcibilss

Hy we have same problem after upgrade our clients to SEP 12 RU1 MP1, some cliente with WinXP SP3, was very slow, and now We identify that all clients who updated from WSUS, was slow too.

So, you can resolve the problem? Any Idea??

das Bild der Dushan Gomezs

@tcbilis, so what is the issue exactly ?

is that only for several random users or consistently acrosss all of the upgraded users ?

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

das Bild der tcibilss

Dushan,

It´s a random users, becouse the first case We reinstall all machine and again machine is very slow, after install SEP 12 RU1 MP1.

So we install version 11 in this machine to resolve at this moment.

Today, We have 40 machines, and 3 have this issue.

das Bild der Dushan Gomezs

Hm.. that is scary :-| please let us updated with your solution as well.

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

das Bild der outrunreds

this all sounds similar to my issue - problem identified with only machines running XP with solid state hard disks....

remove the network cable whilst it's going slow - does the problem go away?

das Bild der hformans

I had a computer running VERY slow with an SSD.  Fixed it by updating the SSD firmware to current levels.  Many of the older (this was a 64 GB SSD) have this issue because they did not handle deletions the way you would expect.  In any case, a firmware refresh fixed the issue.

das Bild der John Santanas

Hi man, may I know what is the model / manufacturer of the SSD and your workstation ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

das Bild der SameerUs

Hi

I am also facing the same issue.

Regards

das Bild der Dushan Gomezs

So what's the update on this issue then ?

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

das Bild der Mohan Babus

Try new version it has lot of enhanced features with improved performance scale. Updated most of the drivers.

SEP 12.1.2 has been released finally..

https://www-secure.symantec.com/connect/forums/sep...

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

das Bild der Dushan Gomezs

Yes I have tried that so far and no issue encountered.

Dushan Gomez
IT Manager
VCP 4 and 5 | MCITP Exchange Server | MCTS SharePoint Server | MCP Windows XP

das Bild der Glenn Jacobss

I can say after a lot of testing that the performance is betetr with the new version, but starting up some applictaies is still slow (a lot less then before).

das Bild der Glenn Jacobss

A small update on this, i know it took a few months 

We upgraded our server to RU2 (Before we only used the RU2 Clients). We tweaked alot of stuff in the manager. (So many i don't even know what is changed smiley ) We disabled everything on the client that we don't use. We created a new feature set for this.

I'm proud to say that we have solved 80% of the slowspeed problems. The other 20% is just a combination between some software and SEP (Like ThinAPP still take 10+ second to startup).

Some numbers:

APP-V packages comes down from 1min+ to a few seconds
Booting is now between 2min and 5 min.
Opening documents is almost instantly.

It was alot of trial and error and patience but in the end it was it worth :-)

I just want to thank everyone here cause we used alot of stuff from this thread and other threads  to tweak our clients and server.

das Bild der SameerUs

Hi

What are the components installed ?

Regards

das Bild der Glenn Jacobss

SameerU,

This is wat we use:

We have a own AV on exchange, we also have a proxyAV. 

We also have a second feature set we are testing for those system that are still slow.
There Advanced downlaod protection and sonar is also disabled but this isn't final yet.

The firewall Policy has only a blank rule for now and alot of stuff isn't enabled in the settings. But in the future this will change.

We used the rule: What we don't use we don't want to install.

das Bild der AjinBabus

Hi,

It does not look to a Symantec Problem, could you check on Task manager which process it taking these much recourses.

We had also same issue while inspecting our clients we found that it is not because of Symantec, because of some HDD issues.

Regards

Ajin

das Bild der Bulbouss

I have noticed a major performance crash in moving from version 12.1.2015.2015 to version 12.1.2100.2093, particularly in accessing databases on a network server from a Windows XP workstation.

Network scanning is disabled.

das Bild der .Brians

It's a known issue. If you disable the firewall only, it should work as normal.

Multiple cases have been opened, including one for myself.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

das Bild der Bulbouss

Thanks. I always disable the Firewall by policy, but I'm going to try adding a new Feature Set with the Firewall component deselected.

das Bild der .Brians

Withdrawing the policy will not work, you need exclude the firewall component for it to work normally. Sorry should've mentioned that.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

das Bild der Bulbouss

Thanks. If I just create a new Install Feature Set (with Firewall deselected), and modify the existing Install Package - will the clients automatically uninstall the Firewall feature?

das Bild der .Brians

It should. Follow this:

How to add or remove features to existing Symantec Endpoint Protection (SEP) client installations

Article:TECH90936  |  Created: 2008-01-18  |  Updated: 2012-05-11  |  Article URL http://www.symantec.com/docs/TECH90936

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

das Bild der AlleninAuburns

We've noticed the same thing. We spent an entire day trying to troubleshoot this and did find that disabling the firewall helped, adding rules to the firewall didn't. I'm not keen on disabling the firewall and have rolled back to 12.1.2015.2015 for the workstations that are accessing the database. 

das Bild der .Brians

Modifying the rules won't help. It has to do with an update to the teefer driver in the latest version. Has been a very large lag in monitoring the traffic going thru the SEP firewall.

The only workarounds right now are to disable/remove the firewall component or roll back to 12.1 RU2.

My case has been escalated to the advanced team.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

das Bild der John Santanas

Yes Allen, that's true, 12.1.2 RU2 is the most stable so far.

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

das Bild der Glenn Jacobss

I tried the newest version on a few computers and after a day i just rolled it back.
12.1.2 RU2 is better if you still have alot of XP systems.

das Bild der SMBguruss

Rollback?

I missing something here, but when I imported the old package and created separate groups for the XP workstations and ensured they are not inheriting from the parent, they seem to reject the older package due to the newer client installed.

I have found searching for the client by IP and redeploying a package in the past works on the same verision, but do not know if it does for going back a verision, is there a specific tech doc that points to rolling back local clients?

Or are you going to the workstation itself and doing this?