Endpoint Protection

Starting new thread for those experiencing this as well. My issue is exactly the same as the last poster from: https://www-secure.symantec.com/connect/forums/sep-ru5-0xc0000005-error

Updated our main server from RU5 to RU6. Never touched the clients, then people saw the notification that App and Dev control needed to restart to install policies. They rebooted. Several of them started to receive 0xc05 application errors when trying to launch various EXEs.

In my case, simply unchecking "Enable this policy" for the app and dev policies, then rebooting the affected computers was able to resolve the issue.

Next in my testing will be trying to secure one of the effected computers and testing to see if it also effects the RU6 client, or just RU5 clients connecting to the RU6 server.

Can you please paste a screen shot of the error ?

Attached.

EXEs I found to fail were: iexplore.exe, mmc.exe, taskmgr.exe, runas.exe

Each failed with the same error.

Matt

I had read previously that the issue may have something to do with the EMBASSY Trust/Security suite.

All of the five computer affected have this installed.

They are all Dells.

1 Latitude d420, 3 Latitude D620, 1 Latitude D630

I think it is better to open a case with symantec support..

A similar issue was fixed in RU5.

Please call support on http://www.symantec.com/business/support/contact_techsupp_numbers.jsp?pid=54619  and get a case created.

Also try to disable application and device control and see if that hleps or not?

This is a successful workaround, as I stated in the original post.

Case was created by my boss prior to this posting.

If you have MR5 or earlier clients which donot have application and device control policy applied, You will need to disable ADC from SEPM during SEPM updates, then turn it back on after the SEPM upgrade to RU6.

Hi Mike

Please log a case with symantec support

Also  keep the Process monitor log handy as it may be asked for

412-230-363

We are also seeing this issue after upgrading our SEPM's to RU6a (from RU5). Because RU6a is such a new client, we have not done enough testing to feel comfortable pushing it out to all our customer machines. Symantec, we need acknowledgement of this issue and, if possible, a patch issued for RU6a. Please.

-Mike

I had this same issue and after opening a support case was told its specifically caused by enabling new RU6 App & Device control policy on RU5 clients.
Its something to do with new XML tags/headers that RU5 doesn't interpret correctly.

If you need to keep running RU5 - Disable the App & device control policy, reboot RU5 clients and voila 0xc05 errors all vanish.
If you can upgrade to RU6 - Upgrade clients to RU6(a), REBOOT,  with the policy still enabled and also no further 0xc05 errors.

Note you must reboot after the RU6 upgrade for the changes to fully take effect and have the 0xc05 errors disappear